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You have a 

LEGAL RIGHT 

to 9n unloclced 
backup copy 

of your 

commercial 

softifirare 



Our editorial policy is that we do NOT condone 
software piracy, but we do believe that users are entitled 
to backup commercial disks they have purchased. 

In addition to the security of a backup disk, the removal 
of copy-protection gives the user the option of modifying 
programs to meet his or her needs. 

Furthermore, the copyright laws guarantee your right 
to such a DEPROTECTED backup copy: 



..."It is not an infringement for the owner of a copy of 
a computer program to make or authorize the making of 
another copy or adaptation of that computer program 
provided: 

1) that such a new copy or adaptation is created as an 
essential step in the utilization of the computer program in 
conjunction with a machine and that it is used in no other 
manner, or 

2) that such new copy or adaptation is for archival 
purposes only and that all archival copies are destroyed in 
the event that continued possession of the computer program 
should cease to be rightful. 

Any exact copies prepared in accordance with the 
provisions of this section may be leased, sold, or otherwise 
transferred, along with the copy from which such copies 
were prepared, only as part of the lease, sale, or other 
transfer of all rights in the program. Adaptations so prepared 
may be transferred only with the authorization of the 
copyright owner." 



United States Code title 17, §117 
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Attention Apple-users: 
Why type those 
l-o-n-g listings when 
you can just Upgrade 
your present sub. to a 
mg/5V4''Disk Combo 
subscription 

■ You may upgrade your current 
subscription to a magazine & disk 
combination by sending S5.50 ($6.50 
foreign) per remaining issue. 

Time to renew? 

■ Check your mailing label to see if you 
need to renew your subscription. 

n Use the order form on this page to 
renew, and don't forget to send your most 
current mailing label to help expedite your 

renewal 

Moving soon? 

■ If you're moving, let us know at least 30 
days in advance. 

■ Issues missed due to non-reciepi of 
Change-of-Addrcss may be acquired at the 
regular back issue rates. 

■ Remember, the Post Office does not 
forward third class mail unless requested. 
COMPUTIST is not responsible for 
replacing issues lost while forwarding order 

is in effect. 



April's Fool 



■■Djm't ^liiE;:;::::;:: 








lScili::Ii:: 



Yes, I want to subscribe to COMPUTIST. Enclosed are funds for an annual (12 issue) subscription. 



I am... D A new subscriber 

D Renewing my current subscription 

D Changing my address (please include last mail label) 
I have.,D an Apple lie, llgs or lie computer 

□ an IBM computer 

Apple— IBM subscription, ., 
G U.S. - $32 

D U.S. .'Canada/Mexico First Class - S45 
n Atl other Foreign - $75 

Apple magdisk combination subscription... 
n U.S. /Canada/Mexico First Class plus Library Disk - StOO 
n All other Foreign plus Library Disk ■ $140 

U.S. Funds drawn on U.S. bank. Allow 4 — 3 weeks for first issue. 



Najne. 



ADff. 



Address 



City 



State 



Zip 



Country. 



.Phoiie_ 



Exp. 



Signature 
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Mail to; COMPUTIST; PO Box I 10846-T; Tacoma, WA 9841 I [306) 474-5750 
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Notes 'n things 

I CLOSED FOR VACATION! 

NOTICE; The offices of COMPUTIST will be closed Mav 4 thru 6, 1988 while Karen (our 
telephone answerer and chief problem solver) takes a few days of much -needed vacation. 

I Solving Subscription Problems 

ATTENTIO.X COMPUTIST Subscribers; Have you been receiving your monthly issues of 
COMPLITISTV Well, lately, we have heard from a lew COMPUTIST subscribers who have not 
been receiving their Issues for up to the last 6 MONTHS!! In a majority of these cases, the 
subscriber's address was correct and the subscription current, but the issues were still being 'lost 
ui mailing'. 

If you've recently had a problem with very late delivery of your COMPUTIST, let us know. 
We're trying to determine if there is any pattern or reason tor the delay. 

■ Each issue of COMPUTIST is shipped by the first of the month. 

Most subscj-ibers will receive their issue by the end of the third week. So. if more than 30 
days have passed or if you are having trouble receiving your monthly issues, don't wail - get in 
touch with us right away! "We'll verify your address and subscription status, and replace UP TO 
the last ,1 months issues of COMPUTIST. 

COMPUTIST is not responsible for, and will not replace, issues unclaimed or lost over 90 
days of relea-se. 

The volunteer customer service department of COMPUTIST... 

strives to bring you the quickest and most reliable service. Most orders are shipped within 2 to 
3 days of receipt, with delivery normally expected within 2 weeks. If you have a problem or an 
order is ninning late, call or write and we'll fix it. Above all, keep a level head. 

We lose volunteers when callers are abusive. Their response to such calls is: "Hey, wail a 
minute. I don't have to listen to that kind of abuse!" and they're gone. 

More than anything. COMPUTIST extends it's warmest thanks to all subscribers and 
contributors. It's your 'support that keeps us going. 



BUGS 

COMPUTIST #51, page 20 



Softkcy i'aT2400AD. In Hne 1060. the last POKH statement reads: POKE 474S2y. 213. 
Change thi's [O read: POKE 47B29, 13. 



COMPUTIST #52, page 15 



.Soltkey for Car Builder. Change 300 :4C E3 03 tC D9 03 to 300 .20 E3 03 4C D9 03. 



COMPUTIST #50, page 23 



Softkey for Oregon Trail. In the second paiagraph somehow' some text was left out. It should 



read: 



The address and data epilogs remained DE M. I'sing Controller Writer, I wrote a 
controller to copy tracks $03-22, [ copied tlic disk with the eonlrollcr to an INITiali/ed disk 
with DOS 3.3 and tried to hoot it. My copy jnst kept rebooting. I examined the HELLO 
program and saw several KEM statements then a last line of CALL 2208. It was evident 
that I was mi.ssing something to make it function properly. 
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New COMPUTIST readers using Apple Us 

are advised to read this page carefully to avoid 
frustration when attempting to follow a softkey 
or entering the programs printed in this issue. 

What is a softkey, anyway? 

Softkej' Is a term which we coined to describe a 
procedure that removes, or at least flrcumvents, any copy- 
protection on a partiftilar disk. Once a softkey procedure 
has been perfomied, the resulting backup copy can usually 
be copied by the normal copy programs (for example: 
C(^YA, on their DOS 3.3 System Master disk]. 

Commands and control keys 

In any article appearing in COMPUTIST, commands 
which a reader is required to perform are set apart by 
being in b oldface and on a separate line. The 
iRETURHl key must be pressed at the end of every 
such command unless otherwise specified. Control 
characters are specially boxed. An example of both is: 

Press I 6 I N ext, p lace one finger on the Cii^ key 
and then press L gJ Rememi aer to enter this command 
line by pressing IRETUBM] , 

Other s pecial combination keypresses include 
i IRESETl or IQBRESETl , In the form er, press 
and hold down t '"-J then press I RESET | [ p the 
latter, press and hold down both GziD and I ti I then 
press I reset! , 

Special requirements 

Special prerequisites for COMPUTIST articles, programs 
and softkeys are usually listed at the start under: 
■ Requirements: 

Software recommendations 

'If Applesoft program editor such as Global Program 
Line Editor (GPLE). 

If Sector-editor such as DiskEdit (in the COMPUTIST 
Starter Kit) or ZAP from Bag of Tricks. 

If Disk-search utility such as The Inspector, the CIA 
or the Core Disk Searcher (in the COMPUTIST Starter 
Kit). 

Uf Assembler such as the S-C Assembler from S-C 
software or Merlin/Big Mac. 

\Sf Bit-copy program such as Copy II Plus. Lodtsmitb 
or Essential Data Duplicator (EDD). 

[Ff Text-editor (that produces normal sequential text 
files) such as Applewriter IT Magic Wit}dow II or 
Screenwriter It. 

If COPYA, FID and MUFFIN from the EX)S 3.3 
System Master disk are also useful. 



Super lOB and Controllers 

This powerful deprotection utility (in the COMPUTIST 
Starter Kit) and its various Controllers are used in many 
softkeys. (It is also on each Super lOB Collection disk.) 



Reset into the Monitor 

Softkeys occasionally require the user to stop the 
execution of a copy-protected program and directly enter 
the Apple's system monitor. Check the following list to 
see what hardware you will need to obtain this ability. 

Apple II -f , He, compatibles: I ) Place an Integer 
BASIC ROM card in one of the Apple slots. 2) Use a non- 
maskable interrupt (NMI) card such as R^lay or Wildcard. 

Apple II + , compatibles: I ) Install an FS ROM 
with a modified reset-vector on the computer's 
motherboard as detailed in the Modified ROM's article 
(COMPUTIST #6 or Book Of Softkeys 111 ) or the Dual 
ROM's article (COMPUTIST ffl9), 

Apple IIb, I!c: install a modified CD ROM on the 
computer's motherboard. Cutting Edge Ent. (Box 43334 
Ren Cen Station-HC; [Detroit, Ml 48243) sells a hardware 
device that will give you this important ability but it will 
void an Apple .'.'c warranty. 

Recommended literature: 

if Apple II Reference Manual 

fJ^DOS 3.3 manual 

If Beneath Apple DOS. by Don Worth and Pieter 

Lechner, from Quality Software 
if Assembly Language For The Applesoft 

Programmer, by Roy Meyers and C,W, Finley, 

from Addison Wesley 

Keying in Applesoft programs: 

BASIC programs are printed in a format that is designed 
to minimize errors for readers who key in these programs. 
If you type: 

lOHOMEiREMCLEAB SCREEN 

The LIST will look lilie: 

10 maB : REM CLEAR SCREEN 
...because Applesoft inserts spaces into a program listing 
before and after every command word or mathematical 
operator. These spaces usually don't pose a problem 
except in line numbers which contain REM or DATA 
commands. There are two types of spaces: those that have 
10 be keyed and those that don't. Spaces that must be 
typed appear in COMPUTIST as delta characters ('). All 
other spaces are there for easier reading. NOTE: If you 
want your checksums (See Computing checksums) 
to match up, you must key ONLY the '' spaces after 
DATA statements. 



Keying In Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as source code. 
Hexdumps are the shortest and easiest format to type 
in. "Vou must first enter the monitor: 
CALL -151 

Key in the hexdump exactly as it appears in the 
magazine, ignoring the four-digit checksum ($ and four 
digits) at the end of each line. A beep means you have 
typed something that the monitor didn't understand and 
must, therefore, retype that line. 

When finished, return to BAS/C with: 
3D0G 

BSAVE the program with the filename, address and 
-length parameters given in the article. 

The source code is printed to help explain a program's 
operation. To key it in, you will need the S-C Assembler 
or you will have to translate pieces of the source code 
into something your assembler will understand (see table 
of ^-C^ssewW*-/- directives in COMPUTIST #17. 

Computing checksums 

Checksums are 4-digit hexadecimal numbers which tell 
if you typed a program exactly as it appears in 
COMPUTIST. 

There are two types of checksums: one created by the 
CHECKBIN program (for machine language programs) 
and the other created by the CHECKSOFT program (for 
BASIC programs). Both appeared in COMPUTIST ff I and 
Ttie Besl of Hardcore Computing. An update to 
CHECKSOFT appeared in COMPUTIST S 1 8. 

If the published checksums accompanying program 
listings and hexdumps do not match those created by 
your computer, then you typed the program incorrectly, 
The line where the first checksum differs has an error. 

CHECKSOFT instructions; 

LOAD plename 
BRlffl CHECKSOFT 

Get the checksums with: I & 1 and correct the 
program line where the checksums differ. 

CHECKBIN instructions: 

CALL -151 

^LQPiD filename 

Install CHECKBIN at an out of the way place 
BRUN CHECKBIN, AS6<IKIW 

Get the checksums by typing the Starting address, a 
pe riod a nd the Ending address of the file followed by 

a \nm. 

Correct the tines at which the checksums differ. 
,. , ,....RDEXed 



COMPUTIST #54 



itpril 



when 
writing a 
letter to... 



Keith Paiker 



RDEX Stands for: 

Reader's Data Exchange 

That means thai when you send in 
articles, softkeys, APTs, etc, you arc 
submitting them for FREE publication in 
this magazine. KDEX does NOT 
purcliase submissions nor do we verify 
data submitted by readers. We will 
print it and it is the responsibility of the 
readers to send in responses when 
anything is wrong. 

• Remember that your letters or parts 
of them may be used in RDEX even if 
not addressed to the Applc-RDEX editor. 
Correspondence that gets published may 
be edited for clarity, grammer and ^pace 
requirements . 

• Because of the great number of letters 
we receive and the ephemeral and 
unpredictable appearance of our part- 
time staff, any response to your queries 
will appear only in RDEX-Applc, so it 
would be more appropriate for you to 
present technical questions to the readers 
and ask for their responses which will 
then be placed in the Apple-RDEX. 

Send your articles and letters on 

DOS 3.3 standard text 
files 

When we get your letter-article in a 
Standard DOS3.3 text file, it is 
immediate!}' uploaded into the most 
current RDEX 11 le. Conventional letters 
must be typed in by us, . .when w^e have 
the time, 

• Address your letters, articles, to: 

COMPLTISJ 

Apple RDEX Editor 

PO Box Ii0846-K 

Tacoma, WA 98411 



Softkey for. . 



Tubeway 

Datamost 



■ Requirements 

~1 2 blank disks (for part 2 & 3) 
U Sector-editor 

C COPYA (from system master) 
C XFER.BOOT' & RESTORE (from 
COMPUTIST #16) 



Tubeway is one of the Tempest type games. 
Even though it's one of the older games put out 
by Datamo.st, in my opinion, it's one of the 
better Tempest copies. Besides great game play 
and original screens, it has a very interesting 
feature, a "soft sound" option. You can turn 
the sound on, off or on softly. I wish other 
programs would incorporate this feiiiure. It sure 
is a blessing when I'm over at a friends house 
and playing a game on his lie. Since his lie 
doesn't have a v olum e control, at 12:00 
o'clock at night a ICGl could wake the dead! 
(It's no fun to play a game without the sound 
effects.) 

I have deprotccted this program in two 
parts. Pait 3 is just the addition of the title page 
at the beginning of die game. However, in order 
to do part 3, you must first do parts I and 2. 

Part 1, the COPYA-able disk 

When 1 first sat down to deprotect this 
program, I attempted to copy it with COPYA. 
Boy, talk about a racket! So now knowing that 
the program used a non-standard DOS, I pulled 
out Trax from Bag of Tricks and let it take a 
look at it, I crossed my fingers, stared at the 
words "Analyzing Data" on the screen, and 
hoped that Trax would be able to handle it. Of 
course, it did. It showed that the first byte of 
the address epilog had been changed. That was 
the <mly change on the whole disk, how simple. 
So knowing the protection used on the program, 
I pulled out COPYA and told it to ignore epilog 
and checksum errors. It copied perfectly. I then 
booted it up, I was alarmed to hear my drive 
grind. I thought to myself, "Could it be a nibble 
count'?". The thought of trying to find a nibble 
count made a cold chill go down my back. Wait 
a minute! This program is stdl trying to read 
sectors with the altered epilog byte. So I pulled 



out my sector editor and read in track $00, 
Sector $03, and changed byte $91 from OF to 
DE. It worked! 

The program was now completely 
deprotccted. (Incidentally Track SOO, Sector 
$03 is equal to memor>' addresses $B900 — 
$B9FF.) 

Step-by-Step 



I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and run COPYA. 

POKE 47426,24 
RUN COPYA 



I 3 I Make the foil owning sector-edit.s to the 
copy you just made. 

Trk Set Byte(s) From To 

DE 



Sm S03- S.91 



DF 



You now have a COPYA-ab\c disk. 

Part 2, The File Copy 

Now that [ had a COPYA-abXc disk. I 
thought I might try to capture the game. (Since 
it is a single load game.) I used XFER.BOOT 
and RESTORE to boot the game in auxiliary 
inemory . After the title page came on, I pressed 
[reset I . I then moved auxiliary to main 
memory and searched through the code for a 
keypress routine. (As you know, if you press 
a key during the tide page it'll run the game.) 
Well, I found the routine and I found the jump 
to the start of the game at $90C9. I replaced 
it with a jump to the monitor and then restarted 
the program. The game loaded and jumped into 
the monitor. After a little snooping, I found the 
starting and ending addresses of the game. 1 
then saved it to my work disk and rebooted to 
try it out. Il worked like a charm 1 

Step-by-Step 



I 1 I With your sector-editor read in track 
$22, sector SOE of your coy K4 -able Totewaj 
disk. At byte SCD you should see 4C 00 M, 
change this to 4C55FF (a jump to the monitor). 
If it's not there, search your disk for the hex 
string:4C00 4eADlC91. Change the string 4C 00 
40to4C59FF. 

BLOAD XFER.BOOT 
PR#3 



r~2 I Insert your COf'r/l-able disk. 
Call 768 
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I 3 I Press a key to skip the title page, 
I 4 I When the drive stops, press 



I RESET) . 

CALL-151 
3FS:4C QO 03 
BLOAD RESTORE 
900<900.90F8 EiS 
A964:Fr Attmvi krge Bfik. 



I B I Save the program. 
BSAVE TUBEWAY,A$90e,L$37FO 

You now have a tile version of Tubeway. 
You ean use F/D to transfer this program to 
other disk;s. If you waat the title pages and the 
pagft flip routine, perform part 3. 

Part 3, Title Pages 

After completing part 2, I thought to 
myself, "Some people might want to have the 
title pages also". So I sat down and produced 
this softkey. When I was scarehing through the 
code in part 2, 1 found all the routines 1 needed. 
All I had to do was to write a little routine to 
BRUN the file TUBEWA Y, instead of loading 
it directly from disk. 

Step-by-Step 

BLOAD XFER .BOOT 



I 1 [ Insert your COPFyl-ablc disk from 
part 1, not the file version. 
CALL 768 



I 2 I When the title page is loaded and 
working, press I RESET | . 
CALL-151 
3F3:4C 00 03 
BLOAD RESTORE 
2000<2000.95F8 Qjv] 



I 3 I Insert the disk with the Tubeway file 
version (from part 2) in the drive. 
BSAVE PICl, A$2000, LS2000 
BSAVE PIC2, A$4000, LS2000 
91D8:4C DC 91 

(Tell jump routine to go to our loader.) 

I 4 I Add the loader routine. 
91DC: A2 OC BD E8 
91E0: 91 20 ED FD CA 10 F7 60 
91ES: 8D D9 CI D7 CS 02 D5 D4 
SIFO: CE D5 D2 C2 34 
BSAVE FLIPPER,A$913B,L$BA 



I 5 I Reboot and type in listing 2. 
10 HOME :D$ = CHR$ (4): PRINT D$ "BLOAD 
PICl" : PRINT DS "BLOAD PIC2" : PRINT 
DS "BLOAD FLIPPER" : POKE 49152,0: 
POKE 49168,0: POKE 49232,0: POKE 
49239,0: POKE 49234,0: POKE 49236,0: 
CALL 37202 



SAVE STARTUP 

That's all there is to it! Now when you want 
to play Tubeway, type: 

RUN STARTUP 

Softkey for... 



Donkey Kong 

Atari so ft 



■ Requirements 

n COPY A (from system master) 
n Sector editor 
D A blank disk 

An ejtamination of the disk with Trax 
shows that the epilog bytes have been changed. 
All that has to be done is to tell DOS to ignore 
epilog errors and use COPYA to copy the disk. 





Step-by-Step 


1 1 1 




RUN COPYA 




1 2 1 At the 


prompt press li-lCl 


1 3 1 Delete line 7Q, 
70 


1 4 1 
CALL151 
B942: 18 
E003G 
RUN 

Follow the 


prompts. 


|_5_J Using your sector-editor make the 
following changes: 

Trk Set 81(16(5) From To 


$00 S03 S35 

S3F 
S91 
S9B 


?■ DE 
? M 
? DE 
? M 



That's all there is to it! 



More DOS tricks 



Here are a tew^ more DOS tricks to add to 
the tabic compiled by Mr. Hart in 
COMPUTIST #43. page 23: 
B989: EA EA Ignore address checksum 

B992: EA EA Ignore address trailer 

B99C: EA EA 

B920: EA EA Ignore data checksum 

B8DF: EA EA Ignore the long gap between 

address and data 



Grab 'Hidden' Hi-res Images with... 

Picture Loader 

Have you ever wanted to load up a title 
page from an unprotected commercial program 
either to print it out on your printci' or to put 
messages such as: "Kids Copy". "Backup 
Copy", or "'Backuped on month/day/year" on 
the title page? Maybe you would like to save 
the title pages to disk and create a "slide show" 
showing all of the programs you've 
deprotected. There are all sortsof uses for this 
program. 

This program can only be used lo load 
pictures that aren't crunched (to conserve disk 
space). Most pictures (that aren't crunched) are 
.stored standard (increasing tracks and sectors) 
or backward (decreasing track.s and sectors). 
So. I've included both "controllers" in the main 
program listing. Sotne programs store their 
pictures in a different way than what this 
program can load. So, you can make your own 
"controller" for that specific program, I'll 
explain everything in a little while. 

Type the Picture Loader program and save 
it. 
SAVE PICTURE LOADER 

PICTURE LOADER 

10 HOME : IF PEEK (768) <> 159 THEN PRINT CHRS 

(4); "BLOAO'DOS'UTILITY" 
20HTAB14: INVERSE : PRINT "PI CTURE^LOADER"; 

NORMAL :HTAB 13: PRINT "BV;''KEITHTARKER" 
30VTAB7: INPUT "SLOT, DR I VE-=>" :SL,D 
40 INPUT "STARTING"TRACK,SECTOR-=>" ;T.S 
50 INPUT"(R)EAD'OR^(W)RITE'DATA?-=>" CJ 
60 IF CI = "R" THENC = 1 
70 IFC$ = "f("THENC = 2 
80 IFCI<>"R" ANDM<>"W"THEN50 
90 INPUT "READ°0R"WRITE'(F)ORWARD'0R"(B) 

ACKf(ARD->" :WA$ 
100 IFWAt <> "F" ANDWAJo "B" THEN 90 
1 10 HTAB 7 : PR I NT " I NSEPro I SK"AND'PRESS°A ^KEY " 

: : GET AJ 
120Y = S192: POKE 49232,0: POKE 49239,0: POKE 

49236,0: POKE 49234,0 
130 FOR I = 1T0 32: GOSUB 160: Y = Y + 256 : NEXT 

: IFC$ = "K"THENTEXT : VTA6 12: HTAB 16: 

PRINT "ALL'DONE," : END 
140GETA?: IFA$ = CHRS(27)THENTEXT: VTAB13: 

HTAB 9: PRINT "BE'SURE'TO'SAVET I CTURE , " : 

END 
150 GOTO 120 
150 POKE 784, T: POKE 789, S: POKE 779, D: POKE 

774. SL* 15: POKE 799, V- INT (Y / 256) * 

256: POKE 804, INT (V / 256) : POKE 794.. C 
170 CALL 768 
180 IFWAS = "B" THEN GOTO 240 
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190 REM STANDARD LOADER 

200 IFS = 15THENT = T+ 1:S = -1 

210 IFT = 35THENTEXT : VTAB 13: HTA6 13: PRINT 

"END'OF'THE'LINE." : END 
220S = S + 1: RETURN 
230 \<m BACKWARD LOADER 
240 IFS = 0THENT = T- 1:S = 16 
250IFT = -1THENTEXT: VTAB 13: HTAB 12: PRINT 

'■STARrOFTHE'LINE.'' : END 
260S = S-1: RETURN 

Checksums 



10 


- 19656 


ue 


- $99BD 


20 


- mn 


150 


- J79S0 


U 


- %^21A 


m 


^;jEF# 


m 


- $flFS« 


170 


- $AC62< 


50 


- $8323 


180 


- J2CB2 


m 


- ?;EE35 


m 


- J.5002-: 


70 


- $83« 


zm 


- ISAFE- 


S0 


- iEm 


2m 


- $221^ 


m 


~ $E?SB 


220 


-■ .JgDAA- 


m 


- $4F8A 


230' 


- $G07B 


m 


- 51E56 


im 


- ^$09.30 


-X^. 


- $4AE1 


zm 


- $A55.A.. 


130 


- 51129 


260 


- $CD96 



Now enter the machine language routine, 
CALL -ISl 

DOS UTILITY 



0300 
0308 
0310 
0318 
0320 
0328 
0330 



A9 90 8D£BB7A9 00aD 
E9 E7 A9 00 8D EA B7 A9 
00 8D EC B7 A9 00 8D ED 
B7 A9 00 8D F4 B7 A9 00 
8DF0B7A9 00 8DF1B7 
A9 B7 A0 E8 20 D9 03 90 
05 AD F5 B7 85 05 60 



J589F 
J39BD 
S90D4 
SDA09 
S7009 
S2FD0 
$41DF 



BSAVE DOS UTILIT7, A$300, L$37 
3QG)G 

How PICTURE WADER works 

Here's a line-by-line explanation of how it 
works. 

1 Check to see if DQS UTILITY is loaded or rot. If 

not, load it. 
2© Prim title and byline. 
.30 Input slot and drive of tlie disk containina the 

picture. 
40 Input starting track and sector to read or write. Enter 

numbers in Decimal. 
50 Enter command (Read or Write). 
60-70 Change cotninand to a number, so DOS UTILITY 

can use it. 
S0 If no commanj chosen, ask again. 
■9© Enter which ■'controller" you want to use, 
100 Ifneither"eontrollcr"chosen,thefiaskagain. 
liO Final prompt,. 



120 Turn on Hi-Rcs page 1 and set loading -address, to 

8192 (S2000). 
130 Read or write ,12 sectors, Increment loading address 

iiy 1% (1 sector), each time a sector is read or 

wrote. If command is "write'' stop after 32 sectors, 

if not continue, 
140 Get key to continue reading. It" 1 ESC.I is pressed, 

quit. 
150 Jump to loading routine. 
160 Set up DOS UTILITY. 
170 Call DOS UTILITY to read or write a sector, 
1S0 Ifcontrollerequals"backward",jumptoEhestart 

of the controller. 
190 STANDARD LOADER 
200 Ifsector=15ihenincreme[ittraek.Setsector=-l. 
210 If track=35 (last track) then end. (Real end=34.) 
220 Increase sector by 1 and remrn to line 130. 
230 BACKWARD LOADER 
■ 240 If sector =0. then dee re ment track . Set sector eq ua I 

to 16, 
250 If iraek=-I (beginning track) then end. (Real 

beginning is 0.) 
'260 Decrease sector by I and return to line 130. 

Eovi DOS UTILITY vifix'&s 

This program uses DOS's built in lOB to 
read and write sectors to disk. Here is a tabic 
to show flow to use the DOS UTILITY 
program. 

Dee Addr Mat It Does 



784 
789 
779 
774 
799 
S04 
794 
6 



Track number 

Sector number 

Drive number 

Slot number * 16 

Low order byte of memorj' bank 

High order byte of memory bank 

Command (01= read, 02= write) 

Error code (See Table !) 



DOS UTILITY sets up the lOB tabic, so 
that you can read a specific track and sector. 
Lastly, it jumps to the vector at $3D9, Thecarr>^ 
flag is then checked for an error. If there is an 
error it's stored at $06. 

With this information you should be able 
to use DOS UTILITY for your own purposes. 

Using the program 

Run PICTURE LOADER and, if needed, 
it will load in DOS UTILITY. 

The first prompt asks you to enter tlie slot 
and drive of the unprotected disk you wish to 
search (Example: 6,2 (for slot 6, drive 2)), 

The second prompt asks you to enter the 
track and sector you wish to start reading or 
writing (When looking for a picture, I usually 
start reading at track I, sector 0.), 

The third prompt asks if you want to read 
or write data. Enter "R" for read or "W" for 
write. (NCiTE: Ifyou wish to write data, your 
picture must already be on Hi-Rcs page 1.) 



The last prompt tells you to insert your disk 
and press a key. If you're reading data, you can 
press any key after the program has loaded in 
32 sectors to co ntinue searching. 

Ifyou press I ESC I , the program will stop. 
After stopping, ifyou want to save the picture 
type in the command: 

BSAVE PICTURE HAME,A$2(IKiKg,LSlFFF 

Finding a picture 

The first thing you need to do is to boot 
up the disk that you wish to search, L«ik at 
the picture carefully! Pick out a big part of the 
picture, so you'll be able to recognize it easily. 

Now run PICTURE LOADER and start 
searching for your picture. Once you think 
you've found the picture, you may have to read 
in a sector before or a sector after to get the 
picture in perfect. 

What do you do when the picture has no 
' "foreign' ' streaks in it, but it looks messed up? 
Look at any text on the picture. If it look.s like 
it has been flipped end over end, try loading 
it with the backward "controller", 

NOTE: You have to add 2 to the track 
value and subtract I from the sector value, in 
order for the program to stop on your "old" 
starting address. Sometimes when you subtract 
1 from the sector value this will decrease the 
track number, I.E. track 01, sector 00 
backwards would be track 2, sector 15, 

A little help 

In oi^der to give you a little help irl using 
this program. I've compiled two lists. One list 
is for the forward "controller" and the other 
list is for the backward "controller". Hopefully 
you have one or more of the programs listed. 



For the Forward Controller 



track 


sector 


The Hobbit title 


1 





AE screens: 1 


1 





2 


5 


O 


3 


9 





4 


13 


O 


5 


17 


O 


6 


21 


O 


7 


25 


o 


8 


29 


o 


Swashbuckler title 


7 





Swashbuckler screens: 1 


21 





2 


19 





3 


5 






Eantavision title 23 O 
Sammy Light foot title 2 O 
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lOB tabic 



Trk Set 



B.C.'s Quest for Tires titles: 1 9 

2 11 O 

Might and Magic titles: I 1 O 

2 lO O 



For the Backward Controller 



Trk Set 



TKe Bard's Tale (play screen) 29 15 

Donkey Kona titles: 1 13 7 

2 16 15 

Dotikev Kong screens: 1 19 15 

2 22 13 

3 25 15 

4 28 15 

Arcticfox title 17 15 

Zaxxpii title 16 6 

G.I. Joe (either side) 34 15 

Wilderness title 28 15 

Buck Rogers title 16 15 



These locations worked Tor my versions, 
but as always, they may not work for your 
version(s). 

Conclusion 

Now that you know all about Picture 
Loader. I hope you enjoy it as much as 1 do. 
Creating ''controllers" for the program is very 
simple. After all there are only two variable.s 
that you have to work with. 

(NOTE: The program can use two 
controllers at the present time. Controller I is 
in lines 190-220 and controller 2 i.s in lines 
230-260,) A minimal amount of programming 
knowledge is required. 

Table of variables 

SL = slot number 
D = drive number 
T = track 

S = sector 

C = sommand (©1 or 02) 

WAS = forward or backward 

A$ = key press (checked once every 32 sectors) 

Y = loading address 



TABLE I 



Error codes 



$10 disk write- protected 
S20 volume mismatch error 
S40 drive error (Example: I/O error) 
%m read error (RWTS will try 48 times to 
read . ) 



$B7E9 slot number * 16 

$B7EA drive number 

$B7EB expected volume number (00 is a 

"wild card" any number is accepted.) 
SB7EC track number 
SB7ED sector number 
SB7FO low-order byte of data buffer 
SB7F1 high-order byle of data buffer 
SB7F4 command code 
$B7F5 error code 
$B7F6 actual volume number 
$B7F7 previous slot accessed 
$B7F8 previous drive accessed 



James W. HeU 



Softkey for.. 



The Science Professor 

Bcrgwall Educational Software 



■ Requirements 

C Super fOB 1.5 

C 10 disks INlT'ed as Boot 

r 77je Science Pivfesudr 

This is a softkey for The Science Professor 
by Rergwall Educational Software, Inc. V2,0 
1986 series of Uniondale. N.Y.. 

A teacher friend of mine asked me to see 
if I could try to make a backup of this very 
good, but expensive, software since very young 
students were using it. I gave il a try, since 1 
have been reading COMPUTIST since day one 
and have previously cracked some programs. 
This was a new experience, though, 

I got out my trusty CIA program and 
attempted to look at the disit. Well, while 
examining track $11 sector $OF, I got that 
dreaded 10 Error. 1 then looked at the track data 
with the Linguist and saw garbage except the 
headers looked normal, so why the error? 

Well, the epilogs were changed, tor one 
thing. The normal DEM were changed to C9AA 
CF. No problem here. Wrong, 10 Error again. 
Plug in OOOO and N into Tricky Dick and it 
read a screen full of garbage again. However, 
track SI 1, sector $0F did have a pattern to it, 
even though it was garbled. 

Upon examining the data with the Linguist, 
I noticed every sector of data started with SEE 
for the first byte of data. This is a non-valid 
character right? This needed some more looking 
into. 

So now lets examine track $00 since it 
does boot. Track S0O, sector SO0 to $09 were 
normal and easily read without error. I read 
each of these sectors in and wrote them out to 
a blank but INlT'ed disk. Then I hooted this 
disk and stopped the computer after it chattered 
a while. 1 printed out SB60O to SBFFF from 



the monitor as a disassembled printout and 
started comparing the data with a normal 
printout. 

Well, there in the read routine 1 found a 
jump $BECA command. At SBECA 1 found 
some resembling code but still changed. The 
$FF was being checked for a negative value. 
Once found go back and continue reading good 
data. So at last, I think, I have found their trick. 

All 1 had to do now is INIT a new disk and 
poke the changed data into my IDE from Super 
lOB, read the protected disk and write out a 
normal disk. With the changed $C9 in the 
epilog, and I needed to poke the checksum error 
routine so it ignored checksum errors, I was 
on my way. Well, to my surprise it worked with 
no problem. The disks did not run properly. I 
had to INIT the disks with a Hello program 
called Boot. 

So the first step in the procedure is to INIT 
10 disks with Boot. Then enter my controller 
and save the controller as SCIENCE. CON for 
all the disks unless you want to do them all at 
once. Then run Super iOB and you have good 
copies of this wonderful program to let all kids 
use without having to go gray while worrying 
about how you are going to afford to replace 
damaged disks. 

The controller is standard, for the most 
part, with a few exceptions. Line 1010 is 
changed to copy track 3 to 34 and lines 
1025,1026,1027 and 1055 are added to put 
the changed code into the read routine area, to 
ignore the checksum atid at l(D^5 to normalize 
the epilogue area. 

Controller 

1000 REM SCIENCE CONTROLLER MODIFIED TK=@ TO 

TK=3 
1010TK = 3:ST = 0:LT = 35;CD = iVR 
ie20TI = TK: GOSUB49a 

1025 POKE 47505, 201: POKE 48842. 189: POKE 
48843, 140: POKE 48844. 192: POKE 48845, 
15: P0KE48a46. 251: POKE 48847. 189: POKE 
48848, 141: POKE 48849. 192: POKE 48850, 
160; POKE 48851, 36: POKE 48852, 1S9.: POKE, 
48853, 140 

1026 POKE 48854, 192: POKE 48855 48: POKE 
46356, 251: POKE 48857 , 189: POKE 48858. 
140; POKE 48859. 192: POKE 48850. 16: POKE 
48861, 251: POKE 48362. 169: P0KE4SS53. 0; 
POKE 48854. 72: POKE 48865. 104: POKE 
48866 . 75 : POKE 48867 , 01 ; POKE 43868 . 185 

1027 POKE 47426, 24: POKE 47348, 234: POKE 
47349. 189: POKE 47350. 140; POKE 47351. 
192: P0KE47352, 16: POKE47353, 251: POKE 
47354, 201: POKE 47355, 173: POKE 47356. 
203. POKE47357. 232: P0KE47358. 75: POKE 
47359. 202: POKE 47360. 190 

1030GOSUB430:GOSUB100:ST = ST + 1: I F ST < DOS 
THEN 1030 
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1040 I FBF THEN 1060 

1050ST = 0:TK = TK+ I: IFTK<LTTHEN 1030 

1055 GOSUE m 

1060GOSUB490;TK = T1:ST = 

1070GOSUB430:GOSUB100:ST = ST + 1: IFST<DOS 

THEN 1070 
1080 ST = : TK = TK ^ 1 ; I F BF = AND TK < LT THEN 

1070 
1090 IFTK<:LTTHEN 1020 
1100 HOME : PRINT ■'OONE'WITH'COPV : END 

Controller Checksums 



1000 - $356B 

1010 - $3565 

1020 - SC21D 

1025 - SDF74 

1026 - $DCAF 

1027 - $12DF 
1030 - J04DE 
1040 - S525B 



1050 - J5C2S- 

1055 - SA866 

1050 - S4BFB 

1070 - S43FE 

1080 - S57BF 

1090 - S82F5 

1100 - S8202 



Don Christensen 



[ used Dudley Brett's softkey for 
Kindercomp from issue ^'i I and it worked fine. 



Softkey far,. 



Police Artist 

Sie-Tecli 



Softkey for.. 



Petro-Caic 

Gulf Publishing 



■ Requirements 

D DEMUFFIN PLUS (see ednoie following 

this letter) 
D XfER.BOOT & RESTORE (from 

COMPUTIST #16) 
n blank disk 

NOTE; This softkey wiil also make non- 
working but cratkable copies of Besc of Muse 
and ABM. also by Muse. 

I 1 I Initialize a blank disk with DOS 3,3, 
INIT HELLO 

I 2 1 Insert disk with erack programs: 
BLOAD XFER.BOOT 

I 3 I Insert disk to be cracked: 
Flu's 
CALL 768 

I 4 I Stop the boot when the prompt 
appears, 
IC'RESETj 

I 5 I Re-enter monitor, insert crack irig disk 

and get busy. 



CALL-151 

BLOAD RESTORE 

3F8:4C 00 03 

6800<B800.BFrF[3Y] 

BLOAD DEMUFFIN PLUS 

B300<6SCI0.6FFFM 

G03G 

L'se tlie = as a wildcard for the filename. 
That's it, I bet this will work for lots of other 
programs when I have time to tiy it. 

As far as your including IBM sofikeys in 
COMPUTIST. as a charter subscriber, I say do 
whatever you have to in order to keep the 
magazine going and don't get down. 

Finally, a big thanks to the volunteer staff. 
You are doing a great job[ 

A A lot of you are using DEMUFFIN PLUS 
{■from the ancient Hardcore Computing Premier 
Issue or the Book Of Sofikeys Volume I}, so 
we 're reprinting the directions for making it. 

...„....,.,,,,,,.. ,„,, ..,..„.. RDEXed 



1900<B800.BFFFL 



How to make... 
DEMUFFIN PLUS 

■ Requirements 

"1 Apple II, II + , He with Ait 
G One disk drive 
n Blank initralized disk 
n MUFFIN (from DOS 3,3 System Master) 
G Programmers Aid ROM (or Integer BASIC 
from DOS 3.3 System Master) 

ML'FFIIN is a program used to transfer 
13-sector flics to I6-Bectordisks. Toaccomplish 
this, it contains an image of 13-sector RWTS 
(Read or Write a Track and Sector), It uses this 
internal RWTS to read the file and then writes 
to your diskette using the external or resident 
DOS. 

DEMUFFIN is created by changing the 
jumps in the program so that it uses the resident 
DOS to read and the internal RWTS image to 
write. Also, the internal RWTS is changed from 
a 13 -.sector image to a 16- sec tor image, 

ri~~| Bool a DOS 3,3 System Master disk, 

I 2 I Select Integer and load MUPFIN, 

IMT 

BLOAD MUFFIN 

I 3 I Enter the monitor and initialize the 
Programers Aid Code -Relocation feature, 

CALL -151 
D4DSG 



I 5 I Move the first Code segnient down to 
$1900, 
1900<B800.BA1D[^] 



[ 6 I Move the data segment. 
.BC57M 



I 7 I Move the last code segment, 

.bfffISy] 

[ 8 I Make the following patches ^ 
1155:00 IE 
115B:D9 03 
1197:A0 20 

15A0:A0 D2 C5 D3 C9 C4 C5 CE 
15AS:D4 AD C4 AE CF AE D3 AE 
15F7:C4 C5 

20A0:A9 IE 8D B9 B7 20 FD AA 
2aA3:4S AS BD 8D B9 B7 68 60 



9 I Savethenew DEMUFFIN p rogram . 



BSAVE DEMUFFIH,A$S03,L$19D0 

DEMUFFIN directions are identical to 
MUFFIN'!,. You want to convert the files, so 
you have to select the disk slot and drive and 
the file name you want to convert. It is helpful 
to type = lor the fde name so dial all the 
available file names will be displayed when you 
answer Yes to the question: "Do you want 
prompting','". Now you can choose which files 
to convert (transfer). 

11 a iile doesn't transfer and you get an 1/0 
ERROR, you'll be returned to the menu. Just 
repeat all the steps but don't bother converting 
die files you have already converted, and hypas.'i 
the problem file (it probably isn't needed by the 
program anyway). Continue to convert as many 
files as you can. 



Richard Granback 



.Softkey for... 



Tlie American Challenge 

Mindscape Inc. 



I 4 I Tell the relocate routine what we're 
moving and where il goes. 



■ Requirements 

G Super lOB 1.5 

G A blank disk 

■ Optional: 

G Lockamith 6.0 (Automatic Boot Tracer) 
G Copy II Plus or sector-editor with disk-search 

capability 
n ConCrolicr Writer (COMPUTIST #16) 
n Apple 11 Reference Manual by Apple 

Computer 
Q Beneath Apple DOS By Quality Software 

I tried the softkey in COMPUTIST #40 for 
The American Challenge on my disk and found 
Mindscapes copy -protection must have taken a 
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different tack. Although the program would 
boot properly, it would display 
'•UNAUTHORIZED COPY" and flounder, 
after the desired race course was selected. 

At this point. I decided to Irj' and remove 
the copy -protect ion myself. The following is a 
description of that process. Those wanting to 
skip through the hows and whys can go directly 
to the step-by -step procedure. 

The first thing 1 checked was the disk 
formatting to see what had been changed and 
what would be needed to convert it to a standard 
DOS 3.3 format. 

Using the Copy I! plus nibble editor, and 
referring to Beneath Apple DOS as a guide, 1 
looked at the data, including address and data 
prolog and epilog mark.s. From this I was able 
to determine thai Mind scape had not changed 
the formatting from the previou.s version, 
leaving epilogs of FF FF as the only formatting 
problem Lo contend with (well within the 
capabilities of Super JOB). 

With this information in hand, I used 
COMPUTIST's CommUer Writer and selected 
normal DOS default values for everything 
except for epilogs of FF FF. Using the resulting 
controller. Super lOB produced a normal DOS 
3.3 formatted disk. This disk is easier to work 
with and also spares my original from any 
mistakes that might happen. 

Now we can tear into the program itself, 
hopefully leaving the protection scheme dead 
m the water. In order to know about where in 
the program to start looking, several 
observations were needed as to what point the 
protection mighl come ink) play. 

Using the .soflkey from COMPllTIST #m 
tor additional clues, I first looked at track SOO 
sector $(Z)B for ihe bytes Larry listed. As 
expected, 1 found diem to be the same. I decided 
to test boot both the original and die copy before 
making any changes, carefully noting any 
differences in the operation of the two. To my 
surprise, the copy ran fine up to the point where 
the desired race course was selected. 

Only after this point did the disk head move 
back to track SO0 and display the dreaded 
■'UNAUTHORIZED COPY" message. 

Other tests included booting with the copy 
and then .swapping in the original disk just 
before .selecting the course. 

1 also tried swapping the copy back in 
immediately after .selecting the course, just 
when the disk head began stepping away from 
track SOO. Both tests re.sulted in the program 
operating perfectly through a complete race. 

Using these clues, I was able to determine 
the following about the protection scheme used . 

1 , Parts of the old protection code oji track 
SOO described in COMPUTIST #40 were still 
there, but no longer used, 

2, The new protection code did not come 
into action until after a race course had been 
selected. 



3. Only track SO©: was involved in any 
nibble-count or checksum operation. 

At last, the attack could begin. Using 
Locksmiths' Automatic Boot Tracer for ease in 
tracing the code, the search began at the point 
where the program waited for keyboard input 
after the c ourse mcti u had been displayed. 

Using iRETURMl as the key input (to help 
keep things simple), I followed the cixle through 
several subroutines (some of the starting 
locations are listed here). 

$8EB9 Wait for keyboard input 

$8E30 Decode the input key 

$8E67 Restore X & Y registers then 

JSR to $68SB 
$688B Start of disk access routines 

In trying to follow the ctxle starting at 
$688B, I quickly found myself in a maze of 
subroutines which turned on the disk drive, 
moved the head to track SOO, read in the data, 
and then proceeded to perform some 
complicated testijig of that data. 

Based on the clues obtained earlier, I knew 
that soincwherc in there the elusive code was 
hiding. Since this was a JSR (a jump to a 
subroutine and return), and not a simple JMP 
(jump without returning), something else was 
actually responsible for deciding what to do 
with the results of the analysis of track $00. 
I decided to go back to the JSR instruction and 
continue from there. The code listed below' is 
what I found. 



The Procedure 



I 1 I Enter the controller using your 



favorite method and save it. 



J8E6C JSR S588B 

J8E5F IDA SC0E8 

J8E72 BCC S8E77 

I8E74 JMP $02F5 

$8E77 PLA 



Disk check routines. 

Turn of f disk drive. 

Branch if carry clear . 

Jump to $02F6 (DOOM!) 

Program continues. 



Upon returning from the subroutine, the 
program turned off the disk drive (accessing 
location $CC/>E8) and wound up jumping lo 
$02F6 if the carry bit was set. A quick trace 
from S02F6 conllrmed that this was indeed not 
the path to enlightenment. 

At this point two options were available, 
bypass the jump to $02F6 only, or try and 
bypass the entire protection subroutine. J chose 
the latter in order to skip the delay caused by 
the track $00 analysis. Change the JSR S6S8B 
(20 8B 68) to JMP $8E77 (4C 77 8E) where the 
program would go if everything was alright. 

All that remains is to locate the ctxie on the 
disk and change it. Using the Copy 11+ scan 
for bytes feature, I scanned the disk for the bytes 
20 8B58 and found the dastardly code on track 
$07. sector SOE, byte $6C. I changed the code 
to a more suitable 4C 77 BE and my copy of 
American Challenge worked fine. Later using 
the Controller Writer. I changed the controller 
to add the sector edit. 



I 2 I Start up Super lOB 1.5 and merge the 
controller. Insert the original and blank disks 
when requested and copy the program. 

Controller 



1000 REM AMERICAN CHALLENGE CONTROLLER 

1010TK = 0:LT = 35:CO = WR:MB= 151 

1020 ST = : Tl = TK : GOSUB 490 : RESTORE : CSOSUB 

190: GOSUB 210: GOSUB 170 
1030 GOSUB 430: GOSUB 100 :ST = ST + 1 : IF ST < 15 

THEN 1030 
1040 I FBF THEN 1060 

1050ST = 0:TK = TK+ 1: IFTK^LTTHEN 1030 
1060 GOSUB 310; GOSUB 230 : TK = Tl ; ST = : GOSUB 

490 
1070 GOSUB 430: GOSUB 100:ST = ST + 1 : IFST<16 

THEN 1070 
1080 ST = : TK = TK + 1 : I F BF = AND TK < LT THEN 

1070 
1090 iFTK< LTTHEN 1020 
1100 HOME :A$ = "ALL'DONE" : GOSUB 450: END 
5000 DATA 213.170.150.213.170.173,255. 

255.255.255 
5010 DATA 3'CHANGES *' 
5020 DATA 7, 14.108.75 
5030DATA7,14,109,119 
5040 DATA 7, 14,110, 142 



Controller Checksums 


1000 


- S356B 


1080 


- J5DC3 


1010 


- S85C6 


1090 


- $1A37 


1020 


- SFC53 


1100 


- $0C37 


1030 


- SAD71 


5000 


- $94B0 


1040 


- S71B6 


5010 


- S9D77 


1050 


- SB973 


5020 


- S0A8D 


1060 


- J71EF 


5030 


- S5A58 


1070 


- J2BF4 


5040 


- S03B0 


Sheldon M. Atterbury 1 


f Softkey for... 




Talisman 






Polarware 





Trk Set Byte(5) From 
107 J0E S5C 20 SB 63 



To 



4C 77 .SE 



■ Requirements 

LI Super JOB Collection 

If you wish to deprotect Talisman by 
Polarware and have the Super JOB Collection, 
just use the controller lor Sword of Kada.vh and 
press "B" when asked lor the di.sk side. 
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Suftkey for.. 



Sank Street Music Writer 

Mindscape 



LJ_J Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilogs and run COPYA- 
POKE 47426,24 
RUN COPYA 

I 3 I Make the following sector-edits to the 
copy you just made. 
Trk ,Sc-t Byte,(s) From To 



i-00 $05 HC-iE 20 44B9 



EA EA 60 



The back side is unprotected so COPYA 
will work. (I find it strange that they copy- 
protected a disk that requires their included 
card, to be plugged into the computer.) 



Peter WUding 



Softkey far.. 



Vocabuiary Adventure I 



The freeing of programs from the chains 
of copy-protection is one of the most 
challenging and rewarding facets of personal 
computing. 

Vocabidary Adventure / is a progrann 
which teaches vocabulary to fifth through 
seventh graders. The game claims to teach the 
student by including new vticabulary with each 
description of a room in a50-ro<.im ca.stle. This 
vocahulary is then tested in a multiple choice 
quiz. A right answer earns a treasure, a certain 
number of points, and passage to the next room. 
A wrong answer, on the other hand, causes the 
student to miss a few idoms, which decreases 
his chances at getting the most points. I found 
the game to quickly become boring, because the 
only objective was to get as many points as 
possible and thus get into the Hall of Fame. 
With no alternate path.s through the castle. 
playing the game more than once is virtually 
unbearable. 

Despite the game's drabness, I will detail 
what to do in order to crack it so that you may 
apply this information to cracking other 
programs as well. 

The protection on ViKabulatj Advenniiv 
I involves a change m the Address and Data 
prologs on the disk. These changes arc BAAA 
95 (Address Field header), and D5AA96 (Data 
Field header). Notice that the protection 
attempts to fool copy programs into thinking 
that the data field is really the address field, 
resulting in a bad copy being produced. 

Many beginners in the field of cracking 



(myself included) don't quite know where to 
begin when they write a controller lor Super 
lOB. As a result of this, I have developed a 
controller which I call the All-Purpose 
Controller. To use it, simply stick in the 
changed Address and Data header values and 
away you go. 

But (you say), what if the epilogs (trailers) 
have also been changed? Well, why not just 
ignore them completely? Just type the following 
and you will ignore both the Addrcii^ and Data 
epilog fields entirely;: 

CALL -151 

B992: EA EA ll^nore tiddren mikr 

B936: EA EA Ignore data miiler 

3DeG 

This way you can copy just about any disk 
with changed marks. 

[ 1 I Initialize a disk. This will be your 
copy to disk. 

I Z I Install the Vocabulary Controller in 
Super lOB 1.5. Don't bother making the two 
changes mentioned above, they're not needed 
to crack this program. 

I 3 I Run Super lOB 1.5. (Don't format the 

disk.) 

That's all. Examine the program (it's 
mostly written in BASIC!). 

Controller 

1000 REM VOCABULARY CONTROLLER 

1010 TK = 3 : LT = 35;ST = 15 : LS = 15 :CD = WR: FAST 

= 1 
1020 RESTORE :GOSUB190: GOSUB210: GOSUB490: 

GOSUB 610 
1030 GOSUB 230-. GOSUB 490: GOSUB 510: IF PEEK 

(TRK) =LTTHEM 1C50 
1040 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1020 
1050 HOME : PRINT "COPrDONE! " : END 
5000 DATA 185,170.150 
5010DATA213.170.150 

5100 REM LINE 5000 IS THE NEW ADDRESS HEADER 
5110 REM LINE 5010 IS THE NEW DATA HEADER 

Controller Checksums 



1000 - $356B 

1010 - S2445 

1020 - $DAB7 

1030 - $EF2E 

1040 - $F76F 



1050 - S945E 

5000 - S5C51 

501G - JF944 

5100 - SBIFI 

5110 - $F8CA 



Joseph P. Karwosbi 



Convert Print Shop Graphics 
into Print Master GrapJiics 

In September. 1987, I purchased 
Printniasrer Plus and found it to have some 



advantages over Print Shop. One disadvantage 
was that I could not use my Print Shop Grjpbics 
with Print Mailer. I have a fair size collection 
of Print Shop graphics. 

I decided that there had to be a way of 
converting my Prim Shop Graphics to Print 
Ma.'iter Graphics . To my surprise, it was easier 
than I thoughtl Here is a step-by-step way of 
converting Print Shop Graphics to Print Master 
Graphics'. 

\ \ \ Format a disk in ProDOS, use 
PMDATA as the volume, name. 

I 2 I Boot Print Master Phis and create an 
Art Lib on your newly formatted disk, I usqd 

MYL IB. 

[~3 I Eooi Copy If Plus (Note: When you 
catalog your data disk, the subdi recto ly should 
be MYLIB.AL :8. You must use Print Master to 
create the subdirectory!) 



["T"! Copy your Prmi Shop Graphics to 
your new data disk - copy them into the 
subdirectory MYLIB.ALB (Note: Copy li Plus 
will convert the files from DOS 3.3 to ProDOS 

for you) 

I 5 i Rename all the files with a '.GKA" 
extension. Example: 
Print Shop name: BEAR 
Print Master Plus name; BEAR.GRA 

That's all there is to it - simple, is it not? 
Good luck, and have fun converting the files. 



Lawrence A. Marbs 



As a recent subscriber to your excellent 
magazine. COMPUTIST, I am attempting to 
locate the following software (mentioned in 
your publication): Bag Of Tricks, CIA, S-C 
Macro Assembler 

Also, I have hot been able lo purchase the 
latest version of ProDOS and DOS 3.3 System 
Utilities. Apple dealers arc of little or no help 
in locating these utilities. Hopefully, you may 
have some information on how to obtain these 
Apple utilities. 



i 



Bag of Tricks 2 by Quality Software ($45 
plus $2 Sihippiugj and S-C Macro Assembler 
($l&0) can he obtained through the S-C 
Software Corporation; P.O. Box 280300: 
Dallas, TX 75228 

Regarding The CIA, the software company 
does not seem to be answering any mail. Our 
suggestion would be to contact various clubs. 
Perhaps a member wotdd like to sell their copy. 
A el id? is also your best bet for obtaining the 
latest version of the DOS 3. 3 and ProDOS 
System Master disk. With the exception of a very 
few, Apple dealers are uniformly unhelpful 
unless you want to buy some software or 
hardware at their inflated prices. 
RDEXed 
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Eric Delbridge 



Softkey for.. 



Seven Cities of Gold 

Electronic Arts Software 



■ Requirements 

n Apple Il-ish computer 

n Sector-editor with 'scati' capabilities (Copy 

II Plus) 
D Blank disk 
D Fast copier witli 'skip-track' abilities. 

When I received Seven Cities of Gold 
(SCO, I searched through my COMPUTlSTs 
for a softkey to no avail. I would have to do 
this one myself. 

Electronic Arts used its old nibble-count 
and imaging of track $06. This is easily 
defeated by skipping tracks $05—06 and 
changing the restart ccxies so the program will 
just continue with the game. There are several 
different versions of SCG, but this crack shpuld 
work for all of them. 



I 1 I Using a fast copier, copy both sides 
of SCG, ignore errors on tracks $05—06. 

I 2 I On side A, scan track SOI for the 
code in the following tabic. Scan for each one, 
one at a time. The format for the changes is 18 
60 xx, the XX being the checksum, (It is 
possible to make a working copy without all the 
changes listed, but the game will restart after 
a certain amount of time.) 



Trk Set Byte 


s) From 


To 


$&i see text 


AC 69 AO 


18 60 DO 




AC 69 05 


18 66 42 




20 FB AO 


18 60 40 




2eFB05 


1S60A5 




20 FE AO 


18 SB 46 




20FE05 


18 60 AB 




20 03 AO 


I8 50 4B 




20 03 05 


18 60 B0 


Playing Tips for... 




Beauracracy 

Infocom 





When you are at the airport with an Omnia 
Gallia ticket, you should go straight to the 
Omni Gallia desk. But OG has been bought 
out by Air Zalagasa. To fmd the Air 
Zalagasa desk, go through lost-and^ found 
then go north. 

I It doesn't matter how early you get to the 
desk, there will always be a fat man there 
who will cause you to miss the plane. No 
matter, just wait and then exchange your 
ticket for an Aii' Zalagasa ticket at the desk. 



I Now go south one move and climb the pillar. 
You will eventually come to the tower. 
When the speaker crackles "Air Zalagasa 
flight 42 requests take off permission", say, 
"Controller, permission denied." Go back 
down to the top of the pillar. Examine the 
speaker. Pull the black wire. Pull the red 
wire. Connect the red and black wires. Now 
you will have 1 1 points and you'll be on the 
plane. 

I Once on the plane, move to seat 3C. When 
the stewardess brings you the llama stew, 
don't eat it, but move to 8D. Then press the 
light button there, causing the seat in front 
of 3C to recline, thus spilling the .soup so 
you don't have to eat it. The rest is easy. 
Make sure you know the order that the 
postage marks on the mail were in! 

Playing Tips for... 



Maniac MansionL 

Lucasfilm (Activision) 



I The key to the dOor is under the mat. 

I To open the door that has no knob, get two 
kids in the front room. Have one stationed 
at the far right gargoyle, and one by the 
door. Have the one kid pull the gargoyle, 
change kids and have the other walk through 
the door. 

Playins Tips for... 



Stationfall 

Infocom 



, To get into the illegal village (essential to 
play the game) go to level 7 and look in the 
wastebasket. Get the crumpled form. Go to 
level 3, and go to the laundry. Press the form 
in the presser. 

I Don't keep the presser on too long! 

I Now go back to level 5. Go to the 
commander's bedroom. Look undci' his bed. 
Get the validation stamp. Validate illegal 
village entry form. Go to the entrance to the 
military module. Put illegal village entry 
fonn in slot. Viola! 

I To change the rank on your ID, go to Shady 
Dan's in the illegal village. Put ID in 
machine, turn machme on and type "9''. 
You now have access to the ship's armory. 

I To get the explosive needed to blow the lock 
on the storage bin in level one, get the 
spacesuit and magnetic boots (don't have 
your ID!) and go out the airlock with the 
thermos. Get explosive and put it in the 
thermos. Then find the series hypcrdiode 
and the detonator. 

1 To know what the dots on the wall of the 
spaceship mean, go to the alien .spaceship, 
type "Script". Lick dots, "unscript". Go 
to mayor's office in village. Get language 
book. Get the paper that flutters out. 



"Script" read paper. "Unscript" you can 
now translate the tastes into English! 

Playing Tips for. . . 



Lurking Horror 

Infocom 



I Once you have the hand, go to the ' 'Alchemy 
Dept." door. Knock on the door. Wait until 
the professor leads you in. Drink the Classic 
Coke. Turn flashlight on. Show professor 
the note you got on the great dome. Enter 
the lab. Wait one turn until the professor, 
is in his own pentagram. Cut pentagram with 
knife. Exit pentagram. Move lab bench, 
open the trap door, go down. Open the trap 
door up, get ring, wear ring, drop knife, get 
vat. Put the hand in the vat, go down, then 
north, then up. Get hand, put ring on hand. 

Playing Tips for... 



King's Quest II 

Sierra-On Line 



■ To get the second key, get the nightingale 
out of Hilga's cave. Cover it with the cloth 
from Neptune's bottle to keep it quiet if 
Hilga is in the cave. Find the souvenicr 
shop. Enter the shop, give nightingale, buy 
brass lamp, Polish lamp. You should now 
have a flying carpel. Ride flying carpel 
across the mounuains. Go right until you find 
the snake. Rub lamp, rub lamp. Put bridle 
on snake. Go right until the cave, and the 
second key! Fly the carpet back across the 
mountains. Make sure you unlock the 
second door and read the third. 

■ For the third key, go to one of the green lake 
scenes. Charon is there, and will ferry you 
across for a price. Give him a treasure, and 
get on the raft. Once on the island, drink 
the potion the pegasus gives you. Enter the 
castle. Go up the spiral staircase, and find 
the candle. Light the candle with one of the 
torches on the wall. Enter the basement. Go 
to the coffin room. If you have garlic, you 
can scare the vampire away. Look under the 
pillow. Behold the third key! 

■ Open the third door and walk through it. 
Take the net you see. Go up as far as you 
can. Cast net. Let fish go. He will give you 
a lift across the ocean. Once on the island, 
find the amulet. Find the crystal tower. 
Walk up the steps (be careful). Find the 
princess. Kiss ihe princess. Hold the amulet 
and think home. You have completed iC;ni.^'.v 
Quest II. 

That ends my Playing Tips for this month. 
Don't feel frustrated. It took me almost two 
months to solve all the games above! 

I would like to comment on the Senior 
Prom 3.0. It is the best piece of hardware I 
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have ever seen, and the on-hoard utilities work 
wonders. Clay Harrel has made it easier tbi' the 
masses to deprotect their own software. 



Controller 



Bill Jetzer 



Softkey for.. 



The Dam Busters 

Aecolade 



■ Requirements 

D Super IQB: 1 ,5: 
a Blank disk 

Dam Busters is an arcade strategy game 
that puts you in the pilot scat of a British 
Lancaster Bomber. You undertake the most 
daring R.A.F. bombing mission ot World War 
II— the bombing of the great power dams of 
Eder, the Sorpe, and the Moehne, deep inside 
Nazi Germany. Along the way, you must fight 
off ME- 110 night fighters, dodge barrage 
balloons and spotlights. 

The protection used is quite simple. 
Everything is in normal DOS format, with the 
exception of track S22, which is not formatted. 
There is only one routine that checks lor the 
protection. It resides on track $13, sector $0B, 
at byte $34, 

All that is required to deprotect the disk is 
{ 1) an RTS (like a RETURN in BASIC) be put 
at the beginning of the protection routine and 
(2) the 5u/J(:'rroB controller variable LT is set 
to 34 instead of 35, 

Type the controller at the end of the article 
and save it. Install it into Super f OB 1 ,5 by your 
favorite method and run it. You now have a 
dcprotected Dam Bu.vfer.s disk. 

Worth Mentioning 

The DOS used on The Dam Busters is a 
version of Beagle Brothers' Pronto DOS with 
a patch that displays the number of free sectors 
every time you catalog a disk. I like to use this 
DOS on disks containing large files because it 
is so fast. The free sector patch is also nice. 
To use this DOS on your blank disks, boot the 
Dam Busters disk and break out of the HELLO 
program by pressing GiB right away. Insert 
your disk and initialize it: 

To use this DOS on your normal DOS 3,3 
disks that already contain files, you can use 
Super JOB to copy tracks $0 - S2 onto your 
disk, or use the Copy fl Plus DOS copy option. 

Also, you can use Copy U Plus or some 
other program to undelete four files tm Dam 
Busters: FREEUP, DISK. MAIN DA TA , and 
DEMO MODE MCP. The last three arc 
useless, but FREEUP might be of interest to 
you. It will display a track by track bit map of 
free sectors on the last disk that was cataloged 
when it is run. 



1009 REM DAM BUSTERS CONTROLLER 

1010 TK = 0: LT = 34: ST = 15; LS = 15: CD = WR: 
FAST = 1 

1920 GOSUB 490: GOSUB 610 
1030 GOSUB 490:T1 = TK:TK = PEEK (TRK) - 1: 
RESTORE : GOSUB 310:TK = Tl : GOSUB 610 

1049 I F PEEK (TRK) = LT THEN 1060 

1050 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1020 
1060 HOME : PRINT "COPV'DONE" : END 

5000 DATA rCHANGES 
5010 DATA 19,11.52,96 

Controller Checksums 



1000 - $356B 1059 - S9FE4 

1010 - S07I5 1059 - S280F 

1020 - S10C5 5090 - H21D 

1030 - $ED5C 5010 - $77ie 

1040 - J2D3E 



Tim Strelchun 



lower case letters 
For Your II Plus 



■ Requirements 

IJ Apple If Plus 

H DOS 3.3 

HI Micro Test Clips (optional) Radio Shack 

CAT NO, 270-370 
12 One 13" length No. 22 wire (optional) 

With the arrival of Apple Computer's new 
line of He's a couple of years back, came a lot 
of teeth gnashing from the II Plus owners who 
mistakenly bought their computers a month or 
so too early. Many of these people have seen 
the He's new features so commonly seen on 
today's computers and wished that they could 
share in some of its luxuries. One dominate new 
Apple He luxurv' was its ability to both display 
and enter lower -case characters. 

The Apple 11 Plus is also capable of this 
eye-easing feature. This article will talk about 
how to do this, with its main focus directed 
towards the entering of lower-ease characters 
using the standard H Plus keyboard. 

Displaying Lower Case 

The process involved in displaying lower- 
ca.se text on the Apple II Plus is quite simple. 
On the motherboard in location A5 is a 16K 
ROM chip that contains the character set 
definitions. It is from the memory on this chip 
that the characters on the text screen originate. 
This chips, socket is compatablc with 2716 



EPROMs. This is not true however, for the 
heavily documented FS ROM chip. All one ha,s 
to do to change their character set is to replace 
this I6K ROM chip in location AS with a I6K 
EPROM burned with a copy of the new 
lowercase character set. 

Cantion: Only do this on Apple U Plus 
Revision 7 motherboards or newer ones without 
RAM Configuration Blocks. If one finds this 
toodiflicuh (i.e. to bum an EPROM with a data 
image), a kit can be bought that contains a 
preburned chip and instructions on how to 
install it. One such kit may be obtained from 
the manufacturer listed at the end of this article. 

It" you are further interested in the process 
of making your own lowercase chips with 
customized character sets, a colleague and I 
have developed a working program to edit the 
character set to your own liking. Write me at 
my address listed at the end of this article if you 
are interested in this customize program or have 
any question.s regarding the installation of the 
EPROM modification above and or displaying 
lowercase on the Apple II Plus. 

Entering Lower Case 

The entering of lower-case characters from 
the keyboard on an Apple II Plus is where the 
process becomes a little more complicated. On 
the Apple II Plus lower-case has many 
compatibility problems. The monit(.>r, Applesoft 
Basic, and DOS 3.3 do not recognize anything 
but the upper-case character set. To further 
complicate things the II Plus keyboard is not 
designed to enter lower-case. Therefore, a 
program must be designed to do these chores 
and several other unmcntioned hangups. As 
mentioned before, the focus of this article is on 
this program. I have done all the difficult work 
so that one may use lower-case entry in most 
programming situations. 

Ke'/board Changes & Usage 

The machine language program i developed 
does quite a few chore.s. It starts by relocating 
the new input routine and the lower-case patch 
routines to sate places in memory. The program 
then modifies the F8 ROM by using the ramcard 
to connect the new input and patch routines. 
Once this is accomplished, the program returns 
control to the system and the new changes are 
connected. 

Once connected, any typing on the 
keyboard will result in lower-case characters 
being displayed (if that is possible on your 
computer). To obtain uppercase use the (ESC J 
key. It IS now a shiftlock. By pressing it once, 
you may type another key and it will be in 
upper-case. Afterwards, the next charact er wil l 
be back in lower-case. By pressing LESCJ 
twice in a row all the characters you type will 
be in uppercase. To tu rn this 'true' shiftlock 
mode off, press lESCi once more. The first 
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escape mode is provided for those users without 
a shit'tkey modification made to their 
computers. It is quite simple to make and allows 
this pro gram to r£;cogni/,e when you press 
[SHIFT I , By this recognition, it can then make 
a character uppercase. 1 will explain later how 
to make the shiftkey modification to your 
computer if you do not already have one 
installed. 

There have been several key 
rearrangements, also. When the shift key is 
pressed and an N, M, or P is also pressed other 
characters are usually generated. These other 
characters have been moved to different key 
positions. A table showing t he key setups will 



follow. In addition, press USEJ to u se th e 



normal escape editing feature instead of lESCj . 
Also, there is an alternate character mode to 
obtain the moved conflicted characters and 
some other characters not previously able to be 
'typed. To switch back and forth between the 
normal mode and the special alternate mode, 
press [PS . 

alternate character mode your 
act normally except for the 



In the 
keypresses 

following: 



key becomes 





( 


{ 




) 


} 




< 


I 




> 


1 




slash 


backslash 

] 




N 


1 
caret 




# 


checkerboard 




- 


tilde 




P 


@ 



The majority of the changes done to the 
system are made di reedy to the copy of the F8 
ROM and the Applesoft ROMs in your 
RAMcard. Changes are also made to the DOS 
in memory when the program was run. All 
these changes allow you to type lowercase input 
now. The commands from the Monitor program 
(L.M.V, etc.), from DOS 3.3 (CATALOG. 
LOAD, BRUN, SAVE, etc.). and from 
Applesoft Basic (LIST, INPUT, READ. 
PRINT, etc.). all may be entered in lowercase 
characters. File names in DOS 3.3 may also be 
saved using the lowercase and alternate 
characters. 

Whenever you are in DOS 3.3 all that must 
be done to install the Keyboard Enhancer is to 
BRUN the file. It would be convlcnient to have 
it automatically run from a bootup program so 
that it would be there upon system initialization. 
If your bootup program is in BASIC just insert 
a line that contains: 

PRINT CHRt (4) "BRUN KEYBOARD ENHANCER' ' 

The Keyboard Enhancer will then be 
installed for use. It will return to your 
program when it is done with its own chores. 



Where It Lives 

The Keyboard Enhancer when BRUN loads 
into S(Z)900. After it has finished executing, 
you must be sure not to overwrite two pages 
in memory. The input routine resides in page 
$03 and the patch routines in page S8F. Both 
of these pages must be preserved. 

Entering the Code 

The Keyboard Enhancer is not that long. 
It takes up less than three pages of memory . 
Enter the monitor (CALL -151) with DOS 
loaded and type the enhancer hex dump. After 
you have fmished that task, save your work 
with: 
BSAVE KEYBOARD ENHANCER, A$0900, 

L$2Z0 

That is all there is to entering something 
that has the potential to be very useful. 

Shiftkey Mod 

To make this modification on your 
computer, you mu.st have a newer Apple 11 + 
eircuit board. A newer 11+ has a piggy hack 
board under the "7" through "*" keys. If this 
is not so on your computer do not perform this 
mod. 

Take your 13" No. 22 gauge wire and strip 
1 /4" of insulation from each of its ends. Fiddle 
with one of the Micro Test Clips to .see how 
it works and then solder one end of the the 1 3" 
wire to it. Now. turn off the power to your 
Apple and unplug it. 

Ltwking towards your computer from the 
front, find the multi-pin connector that attaches 
the piggy back board to the keyboard. Clip the 
Micro Test Clip to the second pin from the far 
right (directly above asterisk key). Now if you 
have a joystick in your 16 pin game port socket, 
remove it. 

Run the 13" wire to the game port and stick 
the unused end into the socket in the fourth hole 
on the right side (looking down with keyboard 
towards you). 



Soldering is not needed on this wire. If you 
had a joystick previously in the socket, you may 
put it back in, Don't worry, the wire is small 
enough to fit in with the joystick. 

You may obtain a lower-case EPROM 
(product name is LCA-2) from: 

Dan Pay mar 

91 Pioneer Place 

Durango, CO 81301 

My current address is: 

Tim Strelchun 

718© SW 189th Ave. 

Beaverton, OR 97007 



KEYBOARD ENHANCER 



0900 


8D81C0A2 00BD00D0 


S3063 


0908 


9D 00 D0 E8 D0 F7 EE 07 


SA7CE 


0910 


09 EE 0A 09 D0 EF 8D 83 


SF16B 


0918 


C0 A2 C9 BD Fl 09 9D 00 


$EF47 


0920 


03CAE0FFD0F5A2 66- 


$9B09 


0928 


BD BA 0A 9D 00 SF CA E0 


$2512 


0930 


FF DO F5 A0 0F A9 EA BE 


J.FB34 


0938 


SB 09 90 00 FD 88 10 F7 


S92C0 


0940 


A0 0C BE 9B 09 B9 AS 09 


S967E 


0948 


9D00FD88 10F4A9EA 


S787C 


0950 


8DB0FF3D0FA1 SD 10 


S40A2 


0958 


A1A9 20 3DADFF8DE8 


SA7BE 


0960 


9FeD6DD5 8DA8D5 8D 


?177A 


095S 


BED5 8DE9D5 8D0BD5 


$FAEE 


0970 


A2 13BDB5 09SD82 09 


$D2F9 


0978 


BDG9 09 8D83 09BDDD 


$A31D. 


0980 


09 8DFFFFCA10EBeD 


IEF05 


0988 


80 C0 50 14 IBICID IE 


JC05E 


0990 


1F20 2B2C2D7E7F80 


j;2B07 


0998 


81 82 83 11 12 13 21 22 


S2D37 


09A0 


23 24 25 26 27 28 29 2A 


$819F 


09A8 


20 4ASF 43 20 00 03 68 


SE322 


09B0 


91 23 AD AD 03 AE AF E9 


SF3C5 


09B8 


EA 0D 0E 6E A9 EA 6F AA 


S295A 


09C0 


EBBFC0 0C0DA3 30 A4 


S4698 


09C8 


31 FFFF9F9FA1 Al D5 


SA000 


09D0 


D5 D5 D5 D5 D5 D5 D5 D6 


SFBF9 


09D3 


D6FBFDFBFD00 8F07 


S82E7 


09E0 


8F 15 8F2C2C2C8F8F 


$F5ED 


09E8 


8F27 8F3A8F60 60SF 


$50C5 


09F0 


8F E5 4E D0 02 E6 4F AD 


SF9CF 


09F8 


63 C0 8D AE 03 AD 00 C0 


SBBAF 


0A00 


10EF8O10C0C9 9BF0 


JCSIE 


0A08 


0BC9 81 F0 1DC9 85F0 


i.5D5A 


0A10 


2A4C4C03ADAA03F0 


$00E2 


0A18 


0BC9 01 F0 07A9 00 8O 


$09C5 


0A20 


AA 03 F0 03 EE AA 03 4C 


$3AD7 


0A28 


00 03 AD AC 03 D0 04 A9 


$4D96 


0A30 


01 00 02 A9 00 8D AC 03 


$0900 


0A38 


4C 00 03 A9 9B BE AE 03 


$C0B2 


0A40 


3D AD 03 AD AE 03 10 05 


K43E 


0A48 


ADAA03F015ADAD03 


$8190 



16 



CSOMPUTIST #54 



April 



0A50 


A2 02DDAF03F0 05CA 


S384E 


1 3 1 Get out your System Master. 


0A58 


10F8 30 0FBDB2 03 4C 


S1E2C 


BRUN FID 


0A60 
0A68 
flA70 
0A78 

0A80 
0A88 
0A9g 
0(|9R 


7A 03 AD AD 03 C9 C0 90 

02 09 20 8D AD 03 AD AC 

03 F0 15 AD AD 03 A2 09 
DDB5 03F0 05CA10F8 

3e06BDBF03 8DAD03 
ADAA03C9 02 F0 05 A9 
00 8DAA03ADAD03AE 
AE 03 60 00 00 00 00 00 
DEDDC0CECDO0A8A9 
BC BE AF Al CE A3 AD D0 


SA773 
S15BA 
SD200 
SF4AE 

SDC72 
SF08C 
SA932 
S7F81 
SF4B7 
S20C1 


Put your Create With Garfield disk in drive 
1, and your newly initialized disk in drive 2. 
Copy all tiles using the wildcard {-). Wlien 
FID asks you for a tilename, press = . It will 
isk if you want prompting. Press N and the 
program will copy all the Tiles from tlie Create 
With Garfield disk to your copy. 


0AA0 
0AA8 


1 4 1 Quit out of FID. Put voui- copy in 
drive 1 and load the file GARFIELD. 


0ABa 


FB FD DB DD DC FC DE FF 


SA07A 


LOAD GARFIELD 


0AB8 


FE C0 B9 00 02 C8 4C 0A 


SD022 


LIST 


0AC0: 8F20A4A1C9E1 90 0S 
0AC8: C9 FB 80 02 29 DF 50 20 


SB7BB 
SA974 


Ah hal This little program has some 
unneeded eodel The program should look like 


0AD0; 0AaFA2 0ADD40A9F0 


SDE25 


his: 


0AD8: 03 CA D0 F8 68 68 4C 18 


SDDFA 


10ONERRGOTO 100 


0AE0: A1BD0102 10 11 A5 0E 


S37DF 


20 POKE 1012.0 


0AE8: F0 16C9 22F0 12A5 13 


S204D 


30 HGR2 


0AF0: C9 49 F0 0C BD 00 02 08 


SA2B7 


35 PRINT "ItAXFILESr' 


0AF8: C9 61 90 02 29 5F 28 60 


sceED 


40 PRINT ""BLOAD START" 


0B00: BD00 02 60C9C0 90 9E 


$9DAC 


50 PRINT '-"BRUN MENU" 
100 CALL -1438 


0B08 


09 El 90 06C9FBB0 02 


$3D5F 


0B10 


29DF38E9 80 60 38E9 


$CC2B 


Take out lines 10, 20, and 100, and save 


0B18 


40 60 20 0C FD 4C 0A 8F 


SB033 


he program, it should work ju.st fine. 

10 
10 


J. Aufderheide 


^^H 


100 

SAVE GARFIELD 

You are done!. 


■ Requirements 




DF 

n hi 


ID 

ank disk 




Soflkey for. . . 



Here are .some so ft keys on some great 
children's software: 

Softkey for. , . 



Peanut's Maze Marathon 



Random House 



Create with Garfield 

DLM 



Softkey for. . 



Snoopy's Reading Machine 

Random House 



DLM's Create With Garfield has been on 
the Most Wanted List for quite some time. The 
copy I have is 2 years old and may be di fferent 
ihan the one currently on the market. A search 
through past COMPUTISTs shows that DLM 
is fond of changing epilogs. This one is no 
different. The disk seems only to have altered 
address and data epilogs of AADE. So, to 
deprotect it, do the following: 

I 1 I Initialize a disk with a fast DOS v~^ — i 



These two can be defeated in almost the 
same way as Garfield. They have address 
epilogs of AA DE. 

I 1 I Initialize a disk with a fast DOS 
(PronioDOS is great) and delete the HELLO 
file. 

INIT HELLO 
DELETE HELLO 



(ProntoDOS is great) and delete the hello Hie 

INIT GARFIELD 
DELETE GARFIELD 



2 I Kill some epilog and checksum errors: 



CALL -151 
B942:18 
B92S:1S 60 
B98S:1S 60 



and 
Master. 

CALL -151 

BMZ:1S 
B9BS:1B 60 
BRUN FID 



Kill some epilog and checksum errors 
run FID from your DOS 3.3 System 



I 3 I Ptit your Random House disk in drive 
1. and your newly initialized disk in drive 2. 



Copy all files using the wildcard ( = ) character 
lor the filename. 

Put your originals away, and use your 
programs without fear. Has anyone ever listed 
all the confirmed ways that original disks crash? 



Stanley PlaDton 



Softkey for. . . 



Practical Grammar 

Intellectual Software 



One of the media personnel from a local 
school system brought me a bo\ of 18 English 
grammar disks from Intellectual Software and 
asked my help m making backups of [he disk.s. 
Unfortunately, some of the disks had already 
been damaged by students, as seems inevitable 
when schools spend lots of money on protected 
software, then put it into the hands of the kids. 
1 was able, however, to come up with a softkey 
that seems to work with the rest. 

The people at Imellcctual were certainly 
busy with their copy -protection schemes I The 
DOS is a slightly-modified DOS .3.3, with 
changed address epilog bytes in tracks 
S0O— S02, the first byte of the address header 
was changed to B7 on most of the rest of the 
disk, there were checksum errors, either 
deliberate or accidental on most tracks, and 
there is at least one track of "garbage", usually 
track S13, that consists mostly of FF bytes. All 
of this meant that using COPYA or SUPER lOB 
might require a fair amount of work, so 1 
decided to FID the tiles over to a standard disk, 
and to write out the instructions .so that the 
school media personnel could do most of the 
work themselves. 

r 1~~| Boot youi- DOS 3. .3 System Miister 
disk. Place a blank disk in the drive and 
initialize it with the name BTUT. 
INIT BTUT 
DELETE BTUT 



I 2 I Tell DOS to ignore the first byte of 
the address hcadci' and address checksum errors 
and use FfD (from System Miisler disk) to copy 
all the nies. 
POKE 47444,41 
POKE 47445,0 
POKE 47498,0 
BRlfH FID 



I 3 I Use the wildcard (=) for the file 
names, answer N on the prompting question. 

Assembly Line Softkeying 

That's it. Most or all of the disks in the 
series, those that have not already teen trashed 
by the kids, should now be in DOS 3.3 format, 
unprotected. 
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If you have a number of these disks to work 
on, you will probably want to make an 
■'assembly line": when you get the first disk 
INlTed with the BTUT file, use a fast copier, 
such as Locksmith Fast Copy to copy this disk 
to enough blanks for the rest of the series. You 
can then getFJi? running as above, and switch 
originals in and out of drive #1 and the copies 
of the INlTed disk into drive ff2 as FID finishes 
the preceding disk, 

Softkey for. , , 



Kslmazoo Teacher's Record Book 2.0 

Hartley Courseware Inc. 



■ Requirements 

C Apple II, II Plus, lie, lie 

D Blank disks 

n Super JOB L5 

D Co/)y///'-/u.S' or equivalent sector-editing and 

file-moving utilities 
D Dos-Up or equivalent DOS mover 
D System Master 

A friend, who is a teacher, brought me his 
new gradebook program and asked me how to 
make a backup. As 1 have successfully copied 
Hartley program.s before with Dave Stanton's 
softkey from COMPUTIST #32, I dug out 
Super lOB 1.5, keyed in the suggested 
controller, and let Super JOB "do its thing" 
to the Hardey Master Disk. 

When I put a standard DOS on the copy, 
however, the program would load partially, 
then crash. Hmmm, it appeared that the gang 
at Hartley had done something a little different, 
so ii was time to investigate further. 

Reasoning that there might be something 
in their DOS, in addition to a change of epilogs 
from DE AA to a DA AA pattern that inight be 
causmg problems. 

The next step was to change the lOB 
coniroller to pick up every track, not just those 
from $C53 on, so that their DOS could be 
examined. 

Using the controller below, and looking at 
the copy with the track mapping and sector 
editing milities of COPY I! Plus, it became 
apparent that Hartley was using a version of 
Diversi-DOS, or another DOS that let track S02 
be used by tiles, since every available sector, 
including those of track SW2, was in use by 
some file or another. 

This was the cause of the failure of my first 
attempt to unprotecl the disk: copying a 
standard DOS to the softkeyed disk .stepped all 
over track S02, resulting in a massive loss of 
file data. 

Remembering that there had been another 
COMPUTIST that dealt with adding space to 
a disk for large files, 1 dug out COMPUTIST 
tfll. and looked at Eric Ondler's alternate 



softkey for Micrazinefi. Yes, it might he 
possible to create a disk with a slightly modified 
DOS 3,3 that would allow file storage in tracks 
$02 and $11 (just to be sate) to replace Harley's 
track $02, which would be lost when DOS was 
put onto the softkeyed disk. Since a lot of space 
would not be required, it would not be 
necessary to add an extra track, so only some 
of Mr, Ondler's procedures would be needed, 
I INIT'ed a fresh disk, then used COPY 
II Plus' .sec lor -editor to make some changes to 
tracks $02 and SI I, based on the edits in 
COMPUTIST if27: 

Trk Set Byte(s) From 



To 



sii %m $40 


$00 


SFF 


SU $00 w 


$00 


$E0 


$11 $00 $7D 


S00 


$3E 


$11 $05 $01 


SU 


$00 


$11 $05 sa2 


$05 


$00 


$02 S01 S9.2 


$69 


$A9 



These edits should make enough room for 
the Record Book M-dsier Disk files, I then 
booted the DOS disk that I had previously 
INlTed and modified in the last step, put it m 
drive #2, put my System Master in drive #1, 
BRAN FID, removed the System Master and 
put the copy of the Harley disk thai I had made 
earlier with Super lOB 1,5 into drive #1. All 
the.se steps might not be strictly necessary , but 
I wanted to be absolutely certain ihat FID would 
be operating under the mles created by the edit, 
and not under standard DOS 3.3. 1 then chose 
the wildcard = and no-prompting options, and 
copied the files from the lOB'ed disk to the 
INIT'ed and modified disk. They all fit. so I 
proudly booted the disk and watched 
developments. Needless to say, the copy 
crashed, in a spectacular fashion that seemed 
to load an APPLESOFT program into a 
graphics screen, flashing a scrambled BASIC 
program on the monitor. 

What now? An examination of Hartley's 
HELLO program and MAIN program turned 
up a reference to a binary file, DDMOVER . 
which was BRUN early in the file loading 
process, DDMOVER seemed to move Divcr.si- 
Dos up in memory, for reasons clear only to 
the folks at Hariley, and which was causing 
programs under standard DOS 3,3 to load into 
graphics screens... The new task before me was 
to somehow get rid of DDMOVER while 
preserving its function of getting DOS out of 
the way of the files. I had a Wildcard routine 
available, DOS-UP, that is a binary file that can 
be BRUN to move DOS out of the way of a 
Wildcard load, so I thought -'Why not try DOS- 
UP instead?' ' I used COPY U Plus lo DELETE 
DDMOVER. to COPY DOS-UP from a 
Wildcard utility disk to my semi -softkeyed 
Grade Book 2. disk, and to RENAME DO.S- 
UP a-i DDMOVER. That way, any references 
to DDMOVER would get DOS-UP instead. 

The next test boot of the softkeyed disk 



provided the message "DOS NOW IN HIGH 
MEMORY" as£i05-tj'/' was BRUN under its 
new alias, and the disk continued to load 
properly. Data disks could be formatted with 
the Record Book 2.0 softkeyed disk, and 
records stored onto them, so the program wa.s 
finally in an unprotected DOS 3.3 COPYA 
format I 

The Supplementary Master disk in the 
package can be softkeyed with the Super fOB 
controller below without other changes. Data 
disks seem to be copyable with COPYA. 

Controller 

1000 REM HARTLEY GRADEBOOK 

1010TK = 0;LT = 35:ST = 15:LS=15:CD = WR:FAST 

= 1 
1020 RESTORE : GOSUB 170: GOSUe490: GOSUB6I0 
-1030 GOSUe 230: GOSUB 490: GOSUB6I0: IF PEEK 

(TRK) = LTTHEN 1050 
1040 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1020 
1050 HOME : PRINT "ALL'DOtJE" . END 
5000 DATA 218.170,218,170 

Controller Checksums 

1000 - $3550 1040 - iD41C 

1010 - S2544 1050 r $FS8B 

1020 - S73B0 5000 - $95FB 

1030 - $4629 



Step-By-Step 



[ 1 j Boot a System Master and INIT a 
blank disk. 

HELLO 
DELETE HEUO 

I 2 I Enter the atiove con t roller into 
SUPER lOB I.S and copy the Master Disk. 

I 3 I Copy the Supplementary Master disk 
with Super SOB and the same controller. 

Put the Supplementary Master original and 
copy away, so you don'i get them confused with 
the Master disk. 



\ 4 I Use a sector editor to make the edits 
to tracks $02 and $11 of the disk you INiTed 
in Step 1 . 

I 5 I Copy the files from the lOB copy of 
the Master Disk that was made in Step 2 to the 
edited disk from Step 4. Don't bother copying 
the DDMOVER file, or DELETE it if you did 
copy it, 

[ 6 ] Copy DOS-UP to the disk you are 
working on, and change its name to 
DDMOVER. If you have some other DOS- 
moving utility instead of DOS-UP. it might 
work as well. 
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7 I Boot the disk. All going well, you 



should get a pcrfcttly functioning COPYA-Mc 
version o^ Teacber'a Record Bcmk 2.0, as well 
as a COPYA-ab\e: Supplementary Master. 



Gary Rohr 



Franklin ACE 2xxx Users 

As the owner of a Franklin personal 
computer, I am always Cinding software and/or 
hardware which works super on an Apple 
personal computer, but refuses to work on my 
Ace. 

This i.s unfortunate for me because I cannot 
obtain the benefits of many valuable products; 
and for vendors, because many will never 
receive a single dollar from me. 

Add to this growing list of pioducts: Senior 
Prom. 

t Softkey for... 



Math Blaster 

Davidson & Associates 



I have a pet peeve regarding software which 
works on Apple computers, but not on my 
Franklin Aec 220O, This is another one of 
those programs. My goal is to trj' to tliid out 
why this program runs fine al! the way through 
the sign on screens and demo .screens but 
refuses to run the actual program. 

While 1 have not, as yet, figured out why 
thi.s program will not run, J have tnanaged to 
remove the protection so that 1 can continue my 
research. 

I noticed that this program was on the 
"Most Wanted" list, and thought I'd shaic what 
I know so far — maybe someone will be able 
to let me know how to get it to run on my 
Franklin;, 

The Protection 

The first step in determining why a 
program won't run, is to be able to have a copy 
to experiment with. 

First step • make a copy - or so I thought. 
My copies made with COPY JI Phis or 
Locksmith failed to boot. The screen fills with 
C's - 1 get a beep and a re-boot. Using a nibble 
editor, 1 looked at various tracks and found 
"ormal ADDRESS and DATA prologs: 
however, the epilogs had been altered to FFs. 

1 initialized a diskette with a HELLO 
program, deleted it, then set up a Super JOB 
eontroMcr to copy the original tracks S3 — $22 
changing the strange epilogues to normal ones, 

I had some problems with read-errors 
during the copy, so 1 poked DOS in a few places 
to ignore checksums and read errors. 

This allowed the copy to run successfully. 



Since the original program disk would 
display the DOS prompt briefly, I thought I 
would find a catalog; however, the CATALOG 
command just displayed trash. 1 tried to boot 
the disk — it wouldn't work. 

Next, I tried to capture the RWTS for use 
in a swap controller and replaced the protected 
DOS with a normal DOS. This wouldn't work 
because their DOS wa.s so heavily modified. 
Within the write routine they jump to another 
routine outside of that which is normally used 
for the RWTS ($B800-BFFF) and Super JOB 
comes to an abrupt stop. 

After looking through my stack of 
COM PUT! ST issues, I found a softkey for 
another Davidson & Associates progratn. J read 
through it to see what protection they used on 
that program. The one thing that caught my eye, 
was the fact that they altered the translate tables, 

I grabbed my trusty BeiKat/2 Apple DOS 
to find the locations of the translate table and 
compared the Math Blaster', version to a normal 
DOS, Sure enough, there was one byte altered 
in both the read and write translate tables. I 
altered my first lOB controller to swap the 
proper/improper translate bytes and 
successfully copied the protected tracks S3— 22, 

I was now able to do a CATALOG and load 
programs from the disk - one was even named 
HELLO. Great! 1 booted the de-protected disk 
and got an error inessagc - 1 believe it was the 
infamous "PROGRAM TOO LARGE". After 
more attempts at trying to get the program to 
run, I decided that their DOS was required. 

I modified my Super lOB controller to copy 
all tracks and then searched the DOS tracks for 
the FF FF epilogue bytes and replaced them 
with normal DE AA bytes. 

Still, the diskette failed to boot successfully. 
By comparing the Math Blaster'. DOS with a 
normal DOS I found the problem to be a jump 
on track ,$00 sector $00. 

Using Di.'ikedit you can read a normal DOS 
sector and write it to the unprotected Math 
Blaster', diskette, or you can change the 5C FE 
BBat offset J4Ato5CFD0a. 

Softkey #1 



I 1 [ Add the following controller to Super 
lOB and when prompted, specil'y yes lor the 
format with volume number 254. 



Controller 

1000 REM MATH BLASTER CONTROLLER 

1010 TK=0 : ST=0 : LT=35 : CD=WR 

I020T1=TK : GOSUE 450 : RESTORE : GOSUB 260 : 

POKE 47426,24 : GOSUB 190 : GOSUB 210 : 

GOSUB 170 
1025 POKE 47786,0 : POKE 47156.171 : POKE 

48224,254 
1030GOSUB430 : GOSUB 100 : ST=ST+1 : IFST<DOS 

THEN 1030 
1040 IFBFTHEN 1060 



1050 ST=e : TK=TK+1 : IFTK<LTTHEN 1030 
1060 GOSUB 2330 : GOSUB 490 : TK=T1 ; ST=0 
1065 POKE 47786.170 : POKE 47166,255 : POKE 

48224.255 
1070GOSUB430; GOSUB 100 : ST=STrl : IFSKDOS 

THEN 1070 
1080 ST=0 : TK=TK+1 ; IF BF=0 AND TK<LT THEN 

1.070 
1090 IFTK<LTTHEN 1020 
1 100 HOME : PR I NT "DONE W t TH MATH BLASTER COPY" 

: END 
5000DATA213,170,150 
5010 DATA213. 170, 173 
5020 DATA255. 255, 255. 255 



I Z I Using Diskedit change the following 
bytes: 

Trk Set Byte{s) From To 



500 100 J4B-4C 


JFEBB 


$FD08 


J00 102 J9E 


I-FF 


JDE 


JA3 


$FF 


JAA 


SAB 


■$FF 


$EB 


S00 S03 W5 


IFF 


IDE 


$3F 


IFF 


$AA 


■m 


m 


JOE 


^.f^B^ 


m 


WA 


S00 S04 S29 


$AA 


$96 


SAA 


$00 

Softkey #2 


$AA 


(Optional 


- cither should work) 



I 1 I Use DOS 3.3 to initialize a disk with 
HELLO then delete HELLO. 
IMT HELLO 
DELETE HELLO 



I 2 I Use the controller with Super JOB 
except change line lOlC) in the ctmtroller so 
the starting track number is $03. (TK = 3: 
instead of TK = 0.) 



I 3 I Run Super lOB copying the original 
Math Blaster', diskette to the diskette initialized 
in step #1 (Specify NO to format question). 



I 4 I After the copy is complete, change the 
Super JOB controller to copy just DOS from 
the original diskette (TK = O : LT = 3). Leave 
alt other values in line 1010 the same 



I 5 I Using a new output diskette, run 
Super lOB to copy the Math Blaster] DOS 
(Specify YES to the format question - specify 
volume # 254) 

I 6 1 You should now have two partially 
deprotected.WafABya.sfcr! diskettes, one which 
contains the programs, and another which 
contains the DOS. 



I 7 I Using Diskedit, read the following 
sectors from the second diskette (the Math 
Blaster'. DOS) and write them back out to the 
first diskette which you initialized with a normal 
DOS, 
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TraiY 



Sectors 



soo 


$01402 


$00 


$06 


$00 


$OA-SOB 


$01 


$02 


$01 


$04 


$01 


$07 


$01 


$09 


$02 


$02-$OF 



rs~~| Check track SOO, sector $02 for the 
following pattern of bytes, wlijeh represent the 
epilog byte checks. 

A9 FF 20 B8 B8 A9 FF 20 B8 B8 A9 FF B8 B8 
...and change to: 

A9 DE 20 E8 B8 A9 AA 20 B8 B8 A9 EB B8 B8 
Note: 1 found the pattern starting at byte 
$9D 

r 9~~| Cheek track $O0, sector $04 at 
approximately byte S09 for: 
B3 B3 A0 E0 B3 C3 C5 B3 A0 E0 B3 C3 C5 B3 A0 E0 B3 B3 
C5AAA0S2B3B3C5AAA0 82C5B3B3AA88 82C5B3 
B3AA88 82C5 
...and change to: 

A9 AB 8D 4B B8 A9 FF 20 DF BC 20 EC BC A9 AA 8D 29 BA 
50 60 A9 FF 8D 4B B8 A9 DE 20 DF BC A9 AA 20 EC BC A9 
96 8D 29 BA 50 



I IQ I This should complete the deprotection 
— the completely deprotceted version is now 
on diskette ^1 . (The second diskette is no longer 

required) 

I 11 I Note: The data diskette is not 
protected and can be copied using any 
""normar' copy utility (i.e.. Super lOB v,\th a 
FAST.C0N controller) 

Softkey for... 



A2-PB1 PinbaU 



Why another softkey for A2-PB1 Pinball? 

As the owner of a Franklin personal 
computer, 1 sometimes feci as though I'm a 
.social outcast, I bought my Franklin because, 
like many people, I thought it was an Apple 
compatible. Well, maybe it is, 1 do have some 
Apple software which runs perfect. On the other 
hand, I have an almost equal amount of software 
tor the Apple which either doesn't work at all, 
or doesn't work entirely correct, 

1 work in a technical support department, 
supporting IBM mainframes and debugging 
system software. Occasionally, I've had to rely 
on assistance from a vendor's technical support 
department to supply fixes ft)r their products. 

Imagine my surprise when I first called a 
software vendor's technical support department 
(o find otit what I needed to do to get their 
software to run on my Franklin, and heard, "It 
doesn't run on a Franklin," - 1 know that! Why 



do you think I called technical support?? How 
do I get it to run on a Franklin? "It doesn't run 
tin a Franklin 1 1 " — Is someone working on this 
problem? Can I expect help soon?? "It doesn't 
run on a Franklinl!!!" 

Although unspoken, I could sense the voice 
at the other end wanting to say, "And 1 don't 
care - and I hope it never does". After dealing 
with a few vendors, I decide - fine - if they want 
to restrict their market share to only Apples and 
leave out the "so-called" compatibles - to heck 
with them! 

I decided that before I tried obtaining any 
more software that I'd find out first which 
software would run on my Franklin. Who 
should know? Well, Franklin Computer 
Corporation - of course So, I sat down and 
wrote a nice letter explaining the problem I was 
having and asked if they could supply me with 
a list of software which would run on my 
Franklin - or a list of which software I should 
stay away from. 

Several weeks later, I received notification 
that they did indeed have a list of compatible 
software, and it's updated monthly. But would 
they send me one?'.' Of course not - "See your 
local dealer" was how 1 believe the letter was 
phrased. 

Of course the dealer doesn't know which 
software is compatible - they say to consult a 
software retailer - and the ones that deal in 
Apple softw'arc won't hardly admit that they 
even know what a Franklin is... I 

Finally 1 decided - this is ridiculous - I've 
written software - I've lixed software - I'll try 
to fi.K it myself. That's when I discovered that 
the world of PCs is not really anothci" world 
at all ■ more like "welcome to the twilight zone. 

Protected software?? I'm not leasing it - I 
bought iti! 1 don't want to sell it - 1 just want 
to be able to use it!ll 

Then I discovered COMPL'TIST, what a 
great magazine! However, 1 was to find that the 
problems were to continue. While attempting 
to use the published softkey to de-protect 
Choplifier, so I could try and get it to run on 
my Franklin, I discovered that I couldn't use 
the method presented (i.e.. move the ROM btxrt 
code to RAM - modify it - and initiate the boot 
from the modified RAM code). 

Obviously, something's different. I figured 
it was going to take awhile to try and determine 
how to do this, and that if I was going to know 
whether or not the process was working - I'd 
better try using a game that normally runs on 
my PC, So, I looked for a game which 1 had, 
and for which there was a softkey that used the 
ROM to RAM method of de-protection — 
A2-PBI Pinball. 

After several days of trying every possible 
combination of solt-switchcs I could think of, 
1 finally gave up on this method of de- protecting 
the A2-PB1 Pinkill. I was about to give up 
altogether when 1 started wondering how many 



people tried, and couldn't dc- protect this game 
with the published softkey. Then I decided to 
come up with an alternate method for us poor 
unfortunates. 

The Protection 

Using my own method of boot code 
tracing, which involves modifying the readable 
sector(s) to jump to the monitor alter loading 
new sectors so I can analyze what has been 
loaded, 1 discovered that the first thing the boot 
process does is to copy page 8 of memory 
($80O-8FF) to page 3 ($30O-3FF) and then 
jumps to the page 3 code. 

I'm relatively new to 6502 machine 
language, so I may be mistaken, but it appeared 
as though bytes were being read from disk - 
cheeking bytes against a table - then storing 
selected bytes into an area of memor>' normally 
occupied by the RWTS. 

I decided that this was going to be a pain. 
There had to be an easier way, especially since 
someone had already researched this to develop 
the original softkey. So, 1 went back to the 
softkey Vubhshed in COMPUTIST #22. by Mr. 
Lcathiean. From here, 1 learned that the 
program is loaded into memory at 
$9O0_91OO, as well as, S300-3FF and 
S800— 8FF, The trick was going to be in 
determining when the data in memory was valid 
and could be captured. 

After timing different phases of the boot 
process (a full boot requires 22 seconds on my 
Franklin), I tried capturing pages of memory 
at different times and then combining them into 
a single BRUNable module (as was described 
in the original softkey) and attempting to 
execute it. 

The Softkey 

Initialize a new diskette: 

NEW 

INIT HELLO 

DELETE HELLO 

Insert original (protected) copy in boot 
drive (make sure it is w rite-protected) and 
initiate the boot process. Carefully time the boot 
process and eighteen .seconds into the boot 
interrupt it whh your favorite method. 

I h ave found on my Franklin, that holding 
down lURESETl nipping open the drive door 
- releasmg the keys - then pressing I 'RESET] 
once again as soon as an attempt is made to read 
the disk is usually enough to interrupt the boot 
process. 

Now enter the monitor and display part of 
page 8 memory. 

CALL -ISl 
850.S5F 

You should see: 

0850= 0D 40 13 08 00 00 00 00 
0858=00 00 00 14 00 00 00 00 
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If not. restart the boot and tr>' alteritig the 
elapsed time allowed before interrupting the 
boot. 

Move page 8 to a "safe" memory location: 

»200<800.8FFM 

Warm boot the original disltette; 
CSOOG 

Wait until btwit ciimpjefes, and the garftfe 
screen is displayed. Then interrupt the game 
with any method you prefer (i.e., I-'BESETJ 
process described above) 
Enter the moniror: 
CALL -151 

Move page 3 to a "safe" memory location: 
9ieO<30(II.3FFM 

Insert your newly initialized diskette into 
the boot drive and perform a warm boot: 

ceooG 

When DOS prompt (Applesoft) appears, 
enter the monitor: 
CALL-151 

Move page 8 back to it's original memory 
location: 
S00<9200.9ZFFM 

And make the following edits: 

030D:20 DA 91 
91DE:91 

91E6:G<B 
A9G4;FF 

And exit the monitor: 

Save A2-PB1 PsnbaU to diskette: 
BSAVE A2-PB1 PIHBALL,A$80D,L$S9F3 

Cold boot the new disk to clear nictriorj' 
(i.e., turn power off and back on) - then load 
your new "un-proteeted" version of A2-PB1 
Pinball into memory: 
BLOAD A2-PB1 PINBALL 

Enter the monitor: 
CALL -IBl 

And move page 8 to a "safe" area of 
memory : 
gZ00<e(IIQ.8FPM 

Insert the original (protected) diskette into 
the boot drive - and perform a warm boot: 
C600C 

Carefully time the boot process - and 
interrupt the boot after 20 seconds into the 
process using your favorite method. 

Then enter the monitor: 
CALL -151 

Insert the new unprotected diskette into the 
boot drive and initiate a wartn boot: 

ceooG 

Enter the monitor: 



CALL -151 

Move page 8 to it's original tnemory 
location: 
8(1K1I<9Z00.92FFM 

Alter DOS to allow a save of greater than 
32K: 
A964:FF 

Exit the monitor; 

[DC] 

And save your completely un- protected 
version of A2-PB1 Pinball to diskette: 
BSAVE AZ-PB1 PINBALL,A$8C1D,L$S9F3 

In Summary 

While my Franklin PC docs have many 
disadvantages - it does have it's advantages as 
well, such as the ability to tlirmat diskettes with 
40 tracks, as well as, the standard 34 track 
format. The speed of the Franklin F DOS 5.0 
is also a plus as can be seen with the following 
timings: 

Boot time 
Original protected version 22 .seconds 
Unprotected version using DOS 3.3 37 seconds 
Unprotected version using FDOS 5,0 8 seconds 



$29 



$2A 



1st 


l,04S,576*s 


(165) 


2nd 


65,536-s 


(164) 


1st 


268. 440, 000 's 


(167) 


2nd 


16,777,216'S 


(166) 





Thomas Purifoy 


A.P.T.for... 


Might and Magic 

New World Computing Inc. 



Carole Fox's APT for Mighi and Magic in 
COMPUTIST ^51 left out a few bits of 
information that are rather important. Since 1 
don't own a Ilgs, I was not able to try out her 
method of changing decimal to hex in BASIC, 

However. 1 did notice that on my version 
of Might and Magic, expericnee. gold, hit 
points, gems, and spell points are written with 
a special formula onto the disk. 

They are calculated together using the 
numbers assigned to certain bits (called 
nibbles). Rob Hal! pointed out in COMPUTIST 
f!^40 that Wizardry uses a similar type formula 
to store experience points. 

Might & Magic sometimes writes two bytes 
onto disk that are for exactly the same thing, 
the byte is just repeated. Therefore, just put the 
same byte twice, where it is ncccessary (all 
attributes, experience level, spell level, and hit 
points use this "double writing"). 

Experience: (use Carole Fox's table to 
match up bytes) 
byte nibble place 

S27 1st I6's. (161) 

2nd I's (160) 

$28 1st 4.096's (163) 

2nd 256's (162) 



i.e. You have 1 ,694,834 experience points, 
thus: 

byte %n = S72 (7xl6)(2)(l) 
where 7x16 = 112 and ZkI = 2 
so. . . 13x40 95 = 53,248 

byte$28 = DC (13x4996) (12x255) 
whete 12;<256 = 3a72 and 1x10 48576 = 1048575 
so . . 9x55,535 = 589.824 

byteS29^ 19 (1x10 48575) {9x6553&J 
so. . . total = 1,5?4;S34 

Jfc For those of you who are not mdiK whiTzes 
try entering $0F in the ri'^ht-hand nw.st 
poaition. Since the value are actiudiy stored m 
reverse, nibble order, a small encoded nuntber 
at the right becomes a large decoded number. 
RDEXed 

Gold and Gems arc stored in exactly the 
same way as experience, except they only use 
three and two bytes, respectively. But. they only 
u,se nibbles up to 4.096 mid 1.048.576. 

Spell Points and Hit Points are a type of 
mixture. They use the special formula and the 
double writing. Therefore, if you have 1,0,34 
hit points, the bytes ypti see woiild look like 
this: (bytes $33-38). 

hex text 

30- 00 49 00 0A 04 0A 04 0A %\!S+-S^S+ 

38- 04 D8 94 00 0D II 12 00 'it Mm 

1 hope that this clears up any 
misunderstandings that anyone might have on 
character editing Might and Magic. Go out 
there and find out what's really "Behind 
YARN", literally. 

C25 Lords ol' Conqiiest, by Elcctrofiic 
Arts, is a wonderful RISK take-off and is very 
challenging and fun. But, like most Electronic 
Arts games, it's protected. 

I copied the disk with Copy II Phis 5,1 fast 
disk copy and got the u.sual read error on track 
6. However, when I searched the disk tor the 
tell-tale nibble count strings (4C 59 A0 . 20 03 A0, 
etc.) I didn't find anything. 

I cataloged the copy and received a list of 
all the files. Copy II Plus said that the file 
"LOC" was the HELLO file and I started to 
investigate. 

I won't go into details, but it just got 
complicated from there. There seems to be four 
different times that the protection routine is 
accessed: one at boot- up, one at the title screen, 
one when production is over, and one when 
development starts. 

If anyone can give me any help on 
de protecting this. I would really appreciate it. 
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A request 

For those people who submit Ilgs softkeys, 
please include some disassembly around the edit 
you made. 

Also, if possible please give a brief 
description of why the edit works (why you did 
what you did). Why? Because Ilgs programs 
are being constantly upgraded and the protection 
routines may move around. 



A quick note 

You should compare the codes listed in the 
softkeys tor Destroyer by Epyx, Top Draw, by 
Styleware, and the Graphic Studio, by 
Accolade. 

I have seen four different versions of this 
same protection routine, implemented in four 
different ways, by the tbrementioned companies 
and Electronic Arts. 

You can usually find the disk check by 
searching tor A2 W A0 00 and A2 21 A0 01. 

I found the string on five different programs 
by three different companies. This leads me to 
believe that they are using a commercial 
protection scheme. 

You might want to keep this in mind when 
trying to softkey other programs that copy, but 
give no read errors. Although the methods used 
to compare the checksums range in technique, 
all the values are within one of each in the four 
different versions I have encountered. The 
values are: 

For track $20, between 1F40 and 200S 
(2O09 for Styleware), 

For track S2K between 1E78 and 1DB0 
(IE79 for Styleware). 

I hope someone may use this information 
in the future. 

Softkey for... 



Graphics Studio 

Accolade 



■ Requirements 

D 3 '/2 "disk- copier 
D 3 Vi "disk-editor 
a Copy ff Plus v8.! 

The Graphics Studio is another Ilgs 
program which uses the new protection routine. 
The protection seems to be a nibble-count on 
tracks $20 and S21 of side one of ihe 3iA"disk 
(again!). 

I searched the disk for A2 20 A0 01 and 
found it on block S98 starting with byte $1A8, 
Here is what the code looks like (on the disk): 



1A5 
1A6 
1A8 
lAA 
lAC 
IAD 
lAE 
lAF 
1B2 
1B3 
IBS 
1B6 
IBA 
IBB 
IBF 
ICl 
1C3 
1C4 
1C5 
1C6 
1C9 
ICA 
ICC 
ICD 
IDl 
1D2 
1D6 
1D8 
IDC 



9DD1 
23 

33 00 00 

34 00 00 
21 

01 

9DD1 
0C 

35 00 00 

35 00 00 
00 

02 00 00 

03 00 00 



1E0: 28 
lEl: 5B 



PHP 

SEP m 

LDX m 

LDY *01 

PHB 

PHK 

RLE 

JSRD19D 

Pie 

BCSlD8(+23) 

TXA 

STA 000033 

TYA 

STA 000034 

LDX S21 

LDY S01 

PHB 

PHK 

PLB 

JSRD19D 

PLB 

BCSlDac+0C) 

TXA 

STA 000035 

TYA 

STA 000036 

LDA ff0fl 

STA 000002 

STA 000003 

PLP 

RTL 





E7 


A9 01 00 


LDA *0001 


EA 


85 F0 


STAF0 


EC 


82 25FF 


BRL 14 (-0B)- 




Now back 


up to 14: 


14 


AD 98 00 


LDA 0098 


17 


D0 03 


eNElC (+03) 


19 


82 D3 00 


BRLEF (+D3) SKIP OVER CHECK 


IC 


A5F0 


LDAF0 


IE 


F0 03 


BE0 22 (+03) 


20 


82 CC 00 


BRLEF (+CC) : SKIP OVER CHECK 



Working my way backwards, 1 found the 

call and the checksum comparisons are on block 

$31 arid looks like this (on the disk): 

4E: AD 33 00 LDA 0033 

51: 38 SEC 

52: E9 40 1F SBC fflF40 

55: 70 03 BVS5A(+03) 

57: 49 00 80 EOR ff8000 

5A: 10 34 BPL90 (+34) 

5C: AD3300 LDA0033 

5F; 38 SEC 

50: E9 08 20 SBC *2008 

63: F0 07 EEQ5C(+07) 

65; 70 03 EVS6A(+03) 

67: 49 00 80 EOR * 8 000 

6A: 30 34 BMI 90 ( + 34) 

5C: AD 35 00 LDA 00.35 

6F: 38 SEC 

70: E9B0 1D SBC #1OB0 

73: 70 03 6VS78(+03) 

75: 49 00 80 EOR #8000 

73: 10 16 BPL90( + 15) 

7A: AD 35 00 LDA 0035 

7D: 33 SEC 

7E: E9 73 1E SBC *1E78 

81: D0 03 BNE86(+03) 

83: 82 6100 BRL E7 (+61) 

86: 70 03 evS8B(+03} 

88: 49 00 80 EOR *3000 

8B: 3003 BMI 90 (+03) 

8D: 82 57 00 BRL E7 (+57) 

Checking the code at E7: 



When looking at the the above code, the 
important instructions are LDA #0001 and 
STA FO. Then the code branches up to 14 and 
checks to see if F0 holds anything but wro. 
From 14 on you can see that 0098 should hold 
a value of 0O0O and (as I said before) F0 
should hold a value of ©001 , With that in mind 
I came up with the following patch: 



14 


9C 98 00 


STZ 0098 


STore0 in 0098 


17 


EA 


NOP 




18 


EA 


WOP 




19 


A9 01 00 


LDA S0001 




IC 


35 F0 


STAF0 




IE 


EA 


NOP 




IF 


EA 


NOP 




20 


32 CC 00 


BRL 


Skip Check 



As you can see the above code stores the 
right values in the right places and then branches 
past the disk check. You now have an 
unprotected backup of the Graphics Studio that 
can be moved to a hard disk. 

Step by step would be: 

I 1 I Copy the 3y2"disk 



I 2 I Make the following edits (on the 
copy); 

Block Byte.(s) 



S31 S14 



From 


To 


AD 98 00 D0 03 
82 D3 00 A5 F0 
F0 03 


90 98 00 EA EA 
A9 01 00 85 F0 
EAEA 



I S I Write the block back to the copy, 
Softkey for... 



Marble Madness 

Electronic Arts 



■ Requirements 

n 512K. Apple Ilgs 
D 3 '/i "disk-copier 
n 3 '/j "disk- editor 
D Copy II Pius v8. 1 

The Ilgs version of Marble Madness has 
improved sound and graphics, plus you can use 
the mouse or play with two players. When 
making a copy, I received no read errors. So 
I assume this is one of the many programs that 
is being protected by using on nibble count on 
tracks $20 and $21 of side one. 
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The game runs under ProDOS 8 and uses 
D0S8.SYSTEM as the HELLO program. 1 
loaded DOSS. SYSTEM into memory and 
started checking things out. 

After much looking I came across a JSR 
to S370O and a BCS (Branch Carr>' Set) at 
S20F3, so I changed the JSR to NOP NOP SEC 
and started the file with 2000G. I was then able 
to play the game. 

The only thing left was to find 20 00 37 on 
the disk and make the change permanent, 

Step-By-Step 

I 1 I Copy the 3'/2"di,sk 

I 2 I Make the following edits oh the copy: 

Block Byte(s) From 



To 



S3ei ?F3 



20 00 37 



EA EA 38 



[_3_J Write the block back to the copy, 
Softkey for. . . 



Top Draw vl. 01 A 

Stylcware Inc. 



■ Requirements 

D 512K Apple Ilgs 
□ 3 'A "disk-copier 
D 3 '/i "disk- editor 
n Copy II Plus v8. 1 

The softkey in COMPUTIST #48 did not 
work for my copy of Top Draw. However, 
using the listed 'from' bytes 1 was able to find 
the protection routine. When I found the 'from* 
bytes, I noticed some text like: "about to 
check", "got a real one!", and "Please insert 
the original Top Draw....''. 

First, my copy had bad blocks from $2EF 
through $2F3, so I thought that Top Draw 
would check for the errors. However, after 
checking the protection, Style ware appears to 
be doing a nibble-count on tracks $2© and $2 1 
of side one, 

I loaded block $393 in and found the 
following: 



008 
00B 
00E 
■011 
013 
017 
018 

0E8 
0EA 
0ED 
BEF 
0F2 
0F5 



20 10 42 
EE C0 42 
ADC2 42 
D0 13 



JSR 4210 
INC42C0 
IDA 42C2 
GNE 026(413) 



22 D3 55 00 JSL 0056D3 
AB PLB 

5B RTL 

Later in the same block; 

C230 REPi(30 161)it wideAccum. 

AD BE 42 LDA42BE 

00 ID BME10C{ + 1D) 

ADBA42 LDA42BA 

C9 B0 ID CMP S1DB0 

30 15 BMI 10C ( + 15) 



0F7 


C9 79E1 


CMPS1E79 


0FA 


10 19 


BPL10C ( + 10) 


0FC 


AD BC 42 


IDA 42BC 


0FF 


C9 40 1F 


CMP«1F40 


102 


30 08 


BMI 10C(+08) 


104 


C9 09 20 


CMP S2009 


107 


10 03 


BPL 10C (+03) 


109 


9CC2 42 


STZ 42C2 


10C 


50 


RTS 



The only important instruction seems to be 
the STZ (STore Zero). With this in mind, I went 
back up to the first portion of the code and 
changed the LDA 42C2 to a STZ 42C2 and the 
BNE 26 to NOP NOP. 

After searching the whole disk, I did find 
the protection routine a second time, but it starts 
on block $52© and continues onto block $521. 

Now you no longer need a key disk and 
may upload the programs to a hard disk. 

The step-by-step method wpiild look like: 



I 1 I Copy the 3i.^"disk, 

1 2 1 Make these edits (on the copy): 

Block Byte(s) From To 
J393 

S520 



$0E 


AO 


9C 


Jll 


D0 13 


EAEA 


5154 


AD 


9C 


J157 


00 13 


EAEA 



I 3 I Write the block to the copy. 
Softkey for. . . 




■ Requirements 

n 512K Apple ilgs 
G 3 '/i ''disk-copier 
G 3 '^ "disk-editor 
a Copy II Plus v8.1 

Having already cracked Winter Games and 
World Catnes, 1 thought that Destroyer would 
use the same type of protection. As it turned 
out, Epyx did use the same disk-check but a 
different type of flag system for a pass or fail . 

I looked at the two other Epyx protection 
routines and found they started out in the sanie 
way: 08 E2 30A2 20A0 0!, 

I booted up Copy II Plus v8 and scanned 
the disk for A2 20A001 and found the following 
on block $3D: 



50: 
5F: 
61: 
63: 
66: 
69: 
60: 
6E: 
70: 



E2 30 
A2 20 
A0 01 
20 Bl 00 
8E D5 00 
80 D6 00 
A2 21 
A0 01 
20 Bl 00 



SEP f30 

LDX *20 
LDY S01 
JSR 0061 
STX 0005 
STY 0006 
LDX S21 
LDY S01 
JSR 00B1 



8 bit wide Accufti. 



i 

73 


8E 03 00 


STX 0003 


76 


80 04 00 


STY 0004 


79 


22 90 02 00 JSL00029C 


7D 


C2 30 


REP S30 16 bit wide Acciirn, 


7F 


AD 05 00 


LDA 00D5 


82 


C9 40 IF 


CMPf(lF40 


85 


90 IE 


BCCA5 ( + 1E) 


87 


C9 08 20 


CMP S2008 


8A 


B0 19 


BCSA5 (+19) 


8C 


AO 03 00 


LDA 00D3 


8F 


C9B0 1D 


CMP SIDB0 


92 


90 U 


BCCA5 ( + 11)- 


94 


C9 78 IE 


CMPfflE78 


97 


B0 0C 


BCS A5 (+00) 


99 


A9 06 00 


LDA ff0005 Set tiags for pass 


9C 


8DE9 01 


STA 01B9 


9F 


A9 07 00 


LDA S0007 


A2 


8DBF01 


STA 01BF 


A5 


22 A8 00 El 


JSL E100A8 



Again, like the two Epyx programs before, 
Dcstwycr is using a nibble count on tracks 520 
and S21 of side one. When making the code skip 
the disk check and set the flags to pass, the 
accumulator is switched from 8 bits to 16 bits. 

So I chose two 2 byte instructions that 
wouldn't change (when loaded in and relocated) 
for the patches, I change the SEP f^m (E2 30) 
to BRA 97 (80 38) and the BCS A5 (B0 0C) to 
REP ff30 (C2 30). 

With these edits, the program will now boot 
and you can play the whole game from an 
unprotected backup. 

The protection routine is found in the file 
SYSTEM. SETUP in the SYSTEM.-'SYSTEM .SETUP 
subdirectory. 

Step by step 

I 1 I Copy the 3 '/i "disk 

I 2 I Make these edits (on the copy): 

Block Byte(s) From To 



J3D 



J50 
J97 



E2 30 
B0 0C 



80 38 
C2 30 



I 3 I Write the block back to the copy, 
Softkey for... 



Winter Gaines 

Epyx 



■ Requirements 

Z) 512K Apple Ilgs 

Q 3'/: "disk-copier 

Z\ 3 '/2 "disk -editor 

a Copy U Plus v8. 1 

The protection on Winter Games is the 
same as on World Games. The entire protection 
code is in the file WNG.SYS16, and follows 
the same pattern as World Games. 



April 



COMPUTIST #54 



23 



First $E12AF3 is loaded with the value of 
©072. then a disk check is run. If the clieck 
passes, nothing happens (except for returning 
of course). However, if the clieck fails then 
$E12AF3 gets loaded with a different value. 

Again, if you would like to check out the 
actual disk check it starts at byte $A5 on block 
S6 1 E. All you need to do is stop the check from 
cvei' being made, then you would have an 
unprotected copy. 

Here is what 1 found on the disk: 

Block $6 IE: 
5E: A9 72e0 LDA »0072 
51: 8FF3 2AE1 STAE12AF3 
65: 20 60 00 JSR 0060 

Block S423; 
BE: AFF3 2AE1 LDA E12AF3 
C2:G9 72 CMP tf72 

C4: P0FC BNEC2 (-4) An endless'- loofi. 

So with the above information, a softkey 
becomes fairly easy. Simply change the JSR 
instruction (20) to a LDA instruction (AD). 

Step-by-step 



I 1 I Copy the disk and make the following 

edits: 

Blpqfrt Eyte(s) From 

■$6IE m 20 



TO 



AD 



Optional : 

Block Byte(s) From 



To 



S423 $BE 



AFF3 2AEIC9 A9 72 8F F3 2A 
72O0FC El EAEA 



Jeif Hurlburt 



The 






Ratings 



^<5<5<5<5 ,,..... 


.:.:„.,.... SUPERB 


^^<5<5.., ,,,,,,.„. 


»,.:... EXCELLENT 


W<5 ^._ 


,,,. . VERY GOOD 


<2<2 


GOOD 


^ 


. . FAIR 


€)............... 


*.' 'j^-v^A.' r r:-<#^> POOR 


®(i) ., .,. 


.,,..„,,,„.„._,,.. BAD 


d)® (!).....=... 


DEFECTIVE 




The Eternal Dagger 



Strategic Simulations 



^^<5^ 



■ Requires: 

D 48K Apple II series 

n one 5 14 "drive 

D second drive is recommended 

When a plague of demon-spawned 
monsters from the Middle Woild threatens dear 
old Arghan, the Fellowship is quick to establish 
a magical link with Ssur, the la.st friendly MW 
wizard. No, they're not goitig to fight the 
monstei's; the portal they have opened is for you 
and your seven brave comrades, it's a one-way 
ride with no guarantees save one: win or lose. 
You will not soon return from the quest for the 
Eternal Dagger. 

To put things in perspective, it appears that 
this sequel to Wizard's Crown began as two 
separate games. Neither, evidently, being quite 
large enough, they were combined, with the 
result that The Eternal Dagger can deliver over 
one hundred hours of play and two distinct 
scenarios. 

You begin at Ssur's tower on a continent- 
sized island swarming with undead warriors, 
evil sorcerors, ogres, giants, etc,— all in the 
service of the Necromancer. Since there arc no 
'friendlies', they've all been transformed into 
monsters. With the only city, Grecnbay, in 
ruins, your party must live off the land. 
Weapons and armor come from enemy 
carcasses and hidden caches; food is obtained 
by hunting or prayer. To win this scenario, you 
must takeout a super dragon, recover the Holy 
Morningstar, and polish -off the Necromancer. 
Whereupon, Grecnbay is restored. Now, you 
can board a ship to Elven Isle and really get 
down to business! (i.e. secure the Eternal 
Dagger and close the portal into the Demon 
World.) 

Altogether, your party will explore three 
,scrolled-map Ultima-type continents, there's 
also a Drarven Isle, and battle through five 
multi-level 'dungeons'. In the latter, all party 
members become visible (and separately 
controllable) as you explore rooms and passages 
packed with furniture, statues, bookcases, 
treasure, and vital implements. Also, there arc 
guard.s to overcome, clever puz/les to .solve, 
and even a princess to rescue! 

In one of three thriving cities, you can 
unload booty, obtain tree healing, purchase 
weapons/armor enhancements, or make use of 
the alchemy lab, (Juicy hint: a high- 



ALCHEMY sorceror can conjure a small 
fortune producing the right kind of spells,) 

Upon any encounter, you have the choice 
of tactical combat or a quickie "computer 
resolution". Thanks to souped-up magic and 
other new features, you will find the latter 
alternative much less attractive than in Wizard's 
Crown. Mainly, tactical combat is just too much 
fim. 

Your fighters, priests, thiefs, (sorcerors, 
rangers, etc.) may be 'gated-in' from Wizard's 
Crown, newly created, or come from a 'pre- 
developed' group. As in Wizard's Croivn, each 
character may combine two or more 
occupations (e.g. priest-ranger): and you spend 
■'experience" points to develop a host of skills 
and attributes. Add an excellent system for 
weapons diffeientiation and enhancement, and 
you have one of the best character development 
schemes anywhere. 

Well documented and easy to 'gct-into'. 
The Eternal Dagger oilers decent sound and 
attractive maps, but fails a bit short in the frills 
area (e.g. no music, no hires text). Still, for 
hard-core questcrs and newcomers alike, the 
game is an extraordinary, consistently 
entertaining, adventuring experience— a 
legitimate candidate for "Best Map-Maze 
Adventure Ever'. 




Donald Duck 's Playground 



<5<S 



1 



■ Requires: 

I] 64K Apple II series 
Zl one 5 W "drive 
Q Joystick 

For computists at a loss for software to 
entertain young visitors. Sierra has come to the 
rescue. Including an illustrated manual, Donald 
Duck's Playground aims to teach addition, 
subtraction, and change-making as Donald 
earns and spends money to build a playground 
for his nephews. 

Guiding Donald along Main Street, you can 
check-in for work sorting produce, go to the 
airport and load packages, or visit the train 
station to direct the Amquack Special as it 
makes pickups and deliveries. Across the way 
are shops run by Minnie, Mickey, and Goofy, 
just the places to select and purchase the 
ladders, swings, slides, and other equipment 
you'll need. Purchased items are automatically 
sent, just down the street, to the playground site, 
a three-level, 3x5 grid with space for fifteen 
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pieces. Of course, you can visit at any time, 
to adjust equipment placement just so and watch 
one of your nephews give ever>'thing a good 
tryout. (At this time, you control the nephew's 
movement.) 

Featuring good hi-res artworic and 
animation, plus some nifty Mtile tunes. Donald 
Duck's Playground looks like it should be fun 
lor the targeted 7-11 age group; and, sure 
enough, it is. Loaded with instructional value, 
this one is a guaranieed entertainer. 



Fast Frames 



Electronic Art's Marble Madness 

If you think it's easy to guide your fearless 
marble through a c-artoon woi'ld of Escher 
landscapes and Rube Goldberg contraptions 
infested by kama-kazi stcclics and other 
baddies— well, you're half right. 

In the llgs release of Marble Madness 
(512K, S34.9.'i from Electronic Arts), levels 
1— III are a breeze. Thereafter, it's time to strap 
on your Arcade Ace helmet. 

Having tried Marble Madness on a couple 
smaller machines, there's no question that 
detailed super- resolution displays and Ilgs- 
powered "marble music' make a world of 
difference in player enjoyment, it's too bad EA 
doesn't complete the parlor-to-PC retrofit. 

At present, you get only about one minute 
per level. This amount of time is not nearly 
enough to try out all the interesting gadgets and 
high scores are not saved to disk. 

Even a simple GAME SAVE would help; 
now you must repeal all ihe easy levels just to 
get another shot at the toughies. 



Micro Prose's Silent Service 

For the combat simulation devotee who 
craves realistic, long-play strategy and tactics, 
it's hard to imagine a better choice than the Ilgs 
release of Silent Service from Micro Prose 
(512K, $39,9S). 

The game offers both short "practice" 
sortee.s and a choice of several full-scale South 
Pacific missions with ranks and scores, based 
upon performance, saved to disk. 

Documentadon is thorough; and, except for 
combining sonar and radar functions in a single 
"map" display, attention to technical detail 
borders on the obsessive— down to a choice 
of steam or electric torpedoes. 

With good speed, excellent graphics, and 
pounding sound to deliver WWII- movie-class 
realism, all you need to do is turn up the amp, 
ttirn down the light?, and DIVE I 



Updates, Etc. 



The Bard is Back, Really 

As The Bard's Tale/llgs programmers 
di.scovered, when Apple warned developers to 
employ only toolbox calls or documented ROM 
hooks to access finnware, it wasn't kidding. 
Well, a new ROM -compatible version of the 
Electronic Ans classic has, at last, been 
released. 

The package 1 received is distinguished by 
an orange spine sticker. 



More Courses 

Accolade's JWeaw 18, undoubted number 
one in Ilgs golf, has acquired several new 
courses. Supplied in Famous Course Disk 
supplements (Volumes II-IV. three courses per 
diskette, SI 9, 95 each) are Turnberry, 
Inverness, Muirfield, Doral, and other 
favorites. 



The Mutating Computer 

When Apple replaced first, the video chip, 
then the ROM, many Ilgs owners, no doubt, 
began to wonder when the design would be 
finished. 

Not to worry; with talk of an impending 
motherboard swap ofTcr (due around mid-year), 
it is apparent that Big Green has hit upon the 
marketing coup of the decade, the "mutating 
computer'"] Basically, every two years or so, 
the MC makes a sort of 'evolutionary hop', 
pacing new developments in hardware and 
firmware. (According to rumor, the next 'hop' 
will boost processor speed and slash ProDOS 
/16 boot time.) 

At $20O-S3O0 per swap, the co.st vis-a- 
vis a 'new model' is relatively minor; in return 
for which MC (llgs) owners enjoy continually 
upgraded performance— not a bad stratagem. 



Too Cold to Boot? 

Here's a wicked little puzzle, which is 
likely to be of more than passing interest to a 
few llgs types. 

On a cool autumn morning, a few weeks 
after getting the ROM upgrade, you turn on 
your computer. This time, instead of booting, 
it plays around with the drives and then 'locks- 
up' with a screen full of garbage. If you wait 
twenty or thirty seco'nds, turn off the machine. 
and try again; everything works finel What's 
the problem? 

If you answered "a bad video chip", give 



yourself a pat on the nose. Evidently, some of 
the upgrade video IC's malfunction at low room 
lemperature, but function normally after just a 
little warm-up. (We /.eroed-in on the culprit 
using Radio Shack circuit coolant.) 

Due to slight differences in the new vs. old 
ROM reset sequence, the bug is less likely to 
show until the new ROM is installed. 

If you have experienced similar, 
inexplicable cold-start boot-up problems, get 
your dealer to try a video chip swap. 



BUI Jetzer 



Softkey for.. 



Animate 

Broderbund 



■ Kequirt^menls 

□ 6 blank disk sides 

C ProDOS disk containing the files PRODOS 

and BASIC.SYSTEM 
D Super lOB L.-S 

Animate is an excellent new product 
released by Broderbund. It allows anyone to 
create professional quality double hi-res 
graphics animation. With the easy-to-use 
drawing and editing capabilities of the program, 
you can easily create simple animation 
sequences, such as a man walking or a bird 
flying. 

You can also use a variety of characters and 
backgrounds already included. You could make 
a show disk for your creations, or use the Watch 
command included with Animate. 

The protection used on the program disk 
is difficult to figure. On the front, a sequence 
of bytes is searched for between tracks and 
stored in memory . Later, these bytes are used 
to check if the disk is a copy or not. The back 
appears to have almost the same protection with 
a little something extra that I couldn't figure out. 

All that is needed to deprotect the front of 
Animate is to change two branch instructions 
to keep searching for the sequence of bytes 
instead of rebooting. 

The back side had some similar protection, 
but it was actually part of another routine that 
also checked for protection. I wasn't sure what 
to do about it, so I just changed some branch 
instructions so that the routine was never 
executed, and it worked fine. 

To deprotect Animate, enter the controllers 
at the end of the article and save them. Install 
the "SIDE A" controller into Super JOB 1.5 
and run it to copy the front side, tn.stall the 
"SIDE B" controller into 5o/3er /OB /.5and 
run it to copy the back side. 

The Animation Library, Background 
Library, Demo Show disk and Programmers 
Aid disks are all unprotected, so you can make 
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a copy of those with any whole disk copier, 
1 had hoped to be able to quit to ProDOS 
from Animate, but several attempts proved 
futile. Since you have to boot the disk to use 
Animate anyway, it's not so serious. 

To use'SHOW. SYSTEM, however, you 
can start from ProDOS, and having to reboot 
after using it caeh time is quite annoying. To 
malie SHO W. S YSTEM qu it to ProDOS , loMow 
these steps: 

I 1 I Insert the front side of the deproteeted 
Animate disk, 
BLOAD SH0W.SYSTEM,A$20<B(I),TS7S 



I 2 I Change a few quit mes.sage.s, 
4658:F4 EF AO DO F2 EF C4 CF 
4660:03 AO 
4BF0:D1 D5 C9 D4 AO AO 



[ 3 [ Replace the old quit routine with the 



new one, 

4C06:ZO 00 BF 

4C10:65 OC 7C 04 00 00 00 00 

4C18:00 00 



I 4 I Save the tile back to disk, 
UNLOCK SHOW.SYSTEM 
BSAVE SH0W.STSTEM,A$2000,TSYS 

If you want to have the same patches on 
the included demo show disk, insert a copy of 
the demo show disk and repeat step 4, 

Controller A 

im^WaANIMATE (SIDEA) 

1010TK = e:LT = 35;ST=15:LS=15:CD = WR:FAST 

= 1 
1020 POKE 47425, 24: GOSUB490: GOSUB 510 
1030 POKE 47426 , 55 : GOSUB 490 :T1 = TK : TK = PEEK 

(TRK) - 1: RESTORE : GOSUB 310:TK = Tl: 

GOSUB 510 
1040 [F PEEK (TRK) = LT THEN 1060 
1050 TK = PEEK (TRK) :ST = PEEK (SCT): GOTO 1020 
1050 HOME : PRINT "COPrDONE" : END 
5000 DATA 2"CHANGES 
5010DATA0.3,65,0 
5020DATAa.3,79,244 

Controller Checksums 



1000 - $356E 

1010 - J2544 

1020 - JB5FB 

1030 - $BB1C 

1040 - $C168 



1050 - $9114 

1050 - SFEE3 

5000 - JAFE0 

5010 - JCF5F 

5020 - JF032 



Controller B 



lSm9.E}iAN/MATE(SIDEB) 

1010TK = 0:LT = 35:ST = 15:LS = 15:CD = m:FAST 

= 1 
1020 POKE 47426,24: GOSUB 490: GOSUB 610 
1030 POKE 47426 . 56 : GOSUB 490 : Tl = TK : TK = PEEK 



ITRK) - 1; RESTORE : GOSUB 310:TK = Tl: 

GOSUB 510 
1040 IF PEEK (TRK) = LT THEN 1060 
1050 TK = PEEK (TRK) : ST = PEEK (SCT): GOTO 1020 
1050 HOME : PRINT "COPY'DONE" ; END 
5000 DATA 3 'CHANGES 
5010 DATA 2.0,137,240 
5020 DATA 2.0.138,1 
5030 DATA 15,11,51,18 

Controller Checksums 

1000 - $356B 1050 - $FEE3 

1010 - $2544 5000 - IFE50 

1020 - $B5FB 5010 - $50BC 

1030 - $BB1C 5020 - $E1C8 

1040 - $C168 5030 - $6DC6 

1050 - $9114 



Brian Svmonds 



I read with interest your comments under 
the letter from Larry Newby in COMPUTIST 
#52, I am one of the "dozens" who have 
previou.sly sent to you an Appleworks database 
file (hat could be used as an index for the 
COMPUTIST, I have sent Mr. Newby a copy 
of my file at no charge and ordered a copy of 
his. Perhaps if everyone who has such a file 
could send a copy to Mr. Newby, he could 
amalgamate them and we would then have the 
"ultimate" file (if he is willing), I will send 
a copy of my file free of charge to anyone who 
can prove that they have a similar file. My file 
does contain copying methtxls where known and 
protection and deprotcetion methods where 
known. For anyone else wishing a copy my 
previous offer still stands — .^end $5 and a disk 
and I will send it to you. 

4637 Willingdon Ave. 

Powell River, B.C. 

V8A 2N1 

Canada 

The purpose is not to make money, but not 
to lose it either. Hats off to Mr, Newby for his 
generous offer, especially considering the tmie 
and work involved. 

How about taking a poll to see how many 
of your readers would like to be able to submit 
letters in Appleworks word proces.sor files or 
at least in ProDOS text files? 

S I'm very sorry if I offended you. I most 
certainly didn 'r mean too. Wc received so many 
letters about Appleworks databases, not to 
mention the readers who sent copies of their 
dislis, that printing diem all would have taken 
several pages. We kicked it around and decided 
to print the most reasonable offer (criteria was 
cost and content, and the decision admittedly 
arbitrary) and simply mention the rest. 

It probably isn 't necessary to take a poll. 
A great many of you already send your letters 
on ProDOS disks in Appleworks fdes. We simply 



convert them to te.xt and tran.ifer them to DOS 
3.3. Tiie reason we ask for DOS 3.3 text flies 
is thai ive have an old (very old) Corvus hard- 
di.sk network s\stetn that is tied into a typesetter. 

Tiie system does not support ProDOS so all files 
have to be in DOS 3.3 format. 

If you convert your Appleworks letter to text 
(with the print-to-text-file option) and tran.sfer 
it to a DOS 3.3 di.'^k, it '.s just one file. For us 
to do all the conversions would mean dozens 
of files and would be time-consuming. It 's tough 
enough getting local volunteers to stop by and 
do some editing. .So if you have to use ProDOS, 
it 's okay. Hut if you 've got the time, give us a 
hand. Hie more work you do the ea.sier it is for 
us and if you think about it, it makes you one 
of the volunteers, even if you never make it to 
Tacoma ', RDEXed 



Don McClelland 



Softkey for... 



Sesame Street 
Electric Coloring Book Series 



Polarware 



■ Requirements ,,. 

a Advanced COPYA 
Q Disk Search Utility 
;71 Sector Editor 
: I Blank Disks 

The Sesame Street Coloring Book series is 
a cute series of programs that allow children 
to color pre-made pictures and learn the 
alphabet or numbers from I lo 10. Each disk 
in the series can be purchased for SI 3,00 to 
$20.00 dependinj; on your retail outlet, 
Polarware, formerly Penguin Software. 
unfortunately protected the disks. The disks are 
in ProDOS format. Both programs use a loader 
to put the pictures on screen. The pictures are 
not stored as files so you will not be able to 
move the programs to a mass storage device. 

Softkey for... 



Sesame Street Numbers 

Polarware 



The disk is formatted with the standard 
address and data marks, SD5 AA 95 and $D5 AAAD 
respectively. This makes things easy. First, 
copy the disk with COPYA. This will produce 
a copy that will not work. 

At the second screen, the program does 
what appears to be a nibble count. To defeat 
the nibble count, we must find where the 
program accesses the disk drive, I searched the 
disk for the bytes $BD89C0, These bytes access 
the disk drive and turn it on. The bytes were 
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found on track SOO sector $OE, track S©4, 
sector SOB and track $12, sector SOD. 

Analyzing the code on each of the 
track/sector locations, it appeareti that track 
$12, sector SOD was the nibble routine. The 
code lo(.)ks for the sequence of bytes D5 AA BB 
then counts the number of FF's then turns the 
drive off. As the routine exits, it sets the Carry 
Flag if an error oceured and clears the Carry 
Flag if all went well. 

So we have a couple of options. We can 
clear the Carry Flag and Return to the main 
program before the disk access or we can let 
it do the nibble count then clear the earr)'. I 
chose the first option just to save on di.sk access. 
I accomplished this by putting 18 60 at track 
$12 sector SOD. Now you have a deprotected 
disk. 



I 1 I Copy the disk with COPYA or any 
other Fast copy program. 

I 2 I Edit the disk. 

Trh Set Byte{s) From To 

SI2 $0D $.00 1 18 50 



Softkey for. . , 



Sesame Street Letters for You 

Polarware 



This disk uses ProDOS as its operating 
systetn, but has the familiar Penguin Address 
Marks. Even tracks (0,2,4,6, ect.) have the 
normal address marks of D5 AA 96. Odd tracks 
(1,3,5,7, ect.) have the altered address marks 
of D4 AA 95. On all tracks, the address trailers 
are modified from DE AA to FF FF. Also on 
further investigation, track $02 is not 
formatted, making COPYA print a "READ 
ERROR" and stop. 

Advanced COPYA was used for its ability 
to continue copying on read errors. This allows 
it to copy right across track S02. 

A For those of you who don 't have Advanced 
COPyA, (Eve never heard of it either) a simple 
change to COPYA will make it ignore errors. 
After the binary file COPY.OBJ0 is loaded, 
stop COPYA and change the byte at S3A 1 from 
60 to 18 (POKE 929,24). Restait COPYA with 
RUN 80 RDEXed 



|"^~~| Boot a DOS 3.3 disk and run 
Advanced COPYA.- 



I 2 I Stop the program and make sotne 



changes. 




[DC] 




CALL -151 




B993:OQ 


ignore Mrm epilogue 


B99D:00 


igmre address epilogue 


B957:00 


ignore Isi brte ofproiogue 


LsiCj 




RUN 





That's all there is. Remember that ProDOS 
and DOS 3,3 are exactly the same at the disk 
level. The major difference is that a ProDOS 
Block is made up of two DOS 3,3 Sectors. This 
allows you to utilize your favorite DOS 3.3 
deprotcction utilities on ProDOS formatted 
5,25" disks. 



J. Nisse] 



Softkey for. . 



Spy's Adventures In Europe 

Pe neii i n / Pol a r w a le 



I 1 I Boot your DOS 3.3 system disk;;. 

CALL-151 
B9S4:29 QO 
698S:18 60 
RUN COFYft 



I 2 I Copy side 1 of your disk. 

Use normal disk copy for side 2. That's it. 

Softkey for... 



Tellstarll 

Scharf Software Systems 



I 1 I Boot your DOS 3.3 system disk. 

I 2 I Put a blank disk in the drive. 

FP 

IHIT TELLSTAR 



I 3 I Boot the original TcUstar U disk and 

after your drive reads the first 3 tracks reset 
into the monitor. 



1950ST = 0:TK = TK+ 1: IFTK< LT THEM 1030' 
1060 GOSUB 490:TK = T1:ST = 0: GOSUB 360 
1070GOSUB430:GOSUB100;ST = St4l: IF ST < DOS 

THEN 1070 
1080ST = e:TK = TK4 1: IFBF = ANDTi^< LT THEN 

1070 
1090 IFTK< LTTHEN 1020 
1100 HOME : PRINT "COProONE" : END 
10010 IF PEEK (5400) < > 162 THEN PRINT CHR$ 

(4) "BLOAD'RWTS.TELLSTAR'II.A$1900" 

Controller Checksums 



1000 


- S356B 


1060 - $9008 


1010 


- S3565 


1070 - I98DD 


1020 


- SE1E8 


1080 - 17422 


1030 


- SF7E9 


1090 - $2DB2 


1.040 


- SD35A 


1100 - $1A55 


1050 


- SEB5B 


10010 - I7CB4 



You can put fast DOS on this copy if you 
want to. 

Softkey for. . . 



Super Sunday Football 

Aval on Hill Games 



I 1 I Boot your DOS 3.3 system disk. 
I 2 I Put a blank disk in the drive;,: 

FP 

INIT HELLO 



I 3 I Boot your original disk and alter your 
drive reads the first 3 tracks, reset into the 
monitor. 



I i I Move the RWTS to a safe localicm. 
190<g<B8(90.BrFFIV[ 



XD Move the RWTS to a safe location, ^-j-j p^^ ^^^ ^^^^^ ^-^^ ^^^ -^^^ initialized 



1900<B800.BFFFM 



I 5 I Put your copy disk in the drive and 
boot it. 



\6 I Place your Super JOB data disk in the 
drive and save the RWTS . 
BSAVE RWTS.TELLSTAR II, AS190e, L$800 



in the drive and boot it. 

I 6 I Place your Super lOB data disk in the 
drive and save the RWTS. 
BSAVE RWTS.SUPER SUNDAY, AS1900, L$SOO 



\~1 I Install the controller listed below into 
Super lOB and copy the original to the disk that 
you initialized with TELLSTAR. 

p8 I When asked, enter N, so as not to 
format the disk while running the controller. 

Controller 

1000 REM TELLSTAR I I CONTROLLER 

1010 TK = 3 : ST = 0: LT = 35 ;CD = WR 

1020 Tl = TK: GOSUB 490 : G0SU6360 : ONERR GOTO 550 

1030GOSUB430:GOSUei00:ST = ST+l: IFST<DQS 

THEN 1030 
1040 IFBFTHEN10W 



I 7 I Install the controller listed below inta 
Super lOB and copy the original to the copy 
disk. When asked, enter N, .so as not to 
reformat the disk. 

If your drive head bangs while reading 
some of the sectors on this disk don't worry 
about it, the copy should still come out ok. This 
is only true while reading the sectors, not while 
writing them. 

Controller 

1000 REM SUPER SUNDAY FOOTBALL CONTROLLER 
1010TK = 3:ST = 0:LT = 35:CD = m 
1020 Tl = TK : GOSUB 490 : G0SUB360 : ONERR GOTO 550 
1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 
THEN 1030 
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1040 IFBFTHEN 1060 

1050 ST = 0:TK = TK - 1 : IF TK < LT THEN 10j'0 
1050 GOSUB 490 :TK = T1:ST = 0: GOSUB 360 
1070 GOSUB 430 : GOSUB 100 ; ST = ST + 1 : I F ST < DOS 

THEN 1070 
1080 ST = : TK = TK + 1 : I F BF = AND TK < LT THEN 

1070 
1090 IFTK < LT THEN 1020 
1100 HOME : PRINT "COPY^NE" : END 
10010 IF PEEK (6400) < > 162 THEN PRINT CHRS 

(4) " BLOAD'RWTS . SUPER' SUN DAY . AI 190S" 

Controller Checksums 



1000 - 13566 

1010 ' J3565 

1020 - SE1E8 

1030 - SF7E9 

1040 - iD35A 

1050 - IEB5B 



1060 - S90D8 

1070 - S98DD 

1080 - J7422 

1090 - J2DB2 

1100 - I1A55 

10010 - $2556 



I 8 I Boot your DOS 3.3 system disk. 

\ 9 I Put the copy you just made into tlic 
drive and enter tlie following: 

FP 

10 DS = CHR$(4) 

20 PRINT DS'BRUN BOOT" 

SAVE HELLO 

You can put fast DOS on this copj if you 
warit to. 

Softkey for... 



Maxwell Manor 

Avalon Hill Games 



I 1 I Bool your DOS 3.3 system disk. 
I 2 I Put a blanic dislc in the drive. 



FP 

INIT HELLO 



I 3 I Boot your original disk and after your 
drive reads the first 3 tracks, reset into the 
monitor, 

r4~~| Move the RWTS to a .safe locatiofi. 

1900<B800.BFFFM 



I 5 1 Put the copy disk you Jusi initialized 
in the drive and boot it. 



I 6 I Place your 5uper/OB data disk in the 
drive and save the RWTS. 

BSAVE RWTS.MAXWELL MANOR, A$1»(»0, 
L$SOO 



I 7 I Install the controllci- listed below info 
.^uper lOB and copy tiie original to the copy 
disk. When asked, enter N, so as not to 
reformat the disk. 



Controller 



1000 REM MAXWELL MANOR CONTROLLER 

1010TK = 3:ST = 0;LT = 35:CD = iVR 

1020 Tl = TK : GOSUB 490 : G0SUB360 : ONERR GOTO 550 

1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 ; I F ST < DOS 

THEN 1030 
104.0 IF BFTHEN 1060 

1050ST = 0;TK = TK + 1: IFTK< LT THEN 1030 
1060GOSUB490:TK^T1:ST = 0; GOSUB 360 
1070 GOSUB 430 : GOSUB 100 : ST = ST 4 1 : I EST < DOS 

THEN 1070 
1080ST = 0:TK = TK+ 1; IFBF = 0.ANDTK< LT THEN 

1070 
1090 IFTK< LTTHEN 1020 
1100 HOME : PR INT "COPrDONE" ■ END 
10010 IF PEEK (6400) < > 162 THEN PRINT CHRS 

(4) "BLOAD'RWTS.MAXWELL"MANOR,AS1900" 



Controller Checksums 


1000 - S356B 


1060 - S90D8 


1010 - 13565 


1070 - S98DD 


1020 - JE1E3 


1080 - $7422 


1030 - $F7E9 


1090 - $2DB2 


1040 - SD35A 


1100 - $1A55 


1050 - SEB5B 


10010 - S8D2D 



You can put fast DOS on this copy if you 
want to. 



John B. Walke? 



Apple lie Paddle Fix 

At the Lethhridge Community College, I 
am coordinating a Computer In-aervicc 
Training Program. Amongst other things, my 
job involves teaching school teachers to use 
computers. In working with teachers, I have 
found some interesting hardware problems. One 
that has stumped me for some time is that 
several of the Apple lie computers in the 
schooks are no longer able to read the x-axis 
from the joystick input. The joystick works fine 
up/down, but not at all left.' right. The same 
joystick tested on another computer works tine. 
This led me to suspect the computer as the 
source of the problem. In one schtxjl, 4 of 11 
computers have this problem. 

Upon examination inside the Apple lie, 
there are 3 IC's at the rear near the input.'output 
(1.70) jack for the joystick/mouse pon. One chip 
has PDL 556 screened on the PC board. The 
556 is a dual timing chip and seemed like a good 
candidate to be responsible for the problem. I 
cut out the existing chip and socketed in a good 
556, but the problem persisted. The second 
most likely candidate is the 74LS251 IC which 
is a data selector/multiplexer. Replacing this 
chip fixed the problem. 

The information which follows de.scribes 



how lo fix the Apple He paddle problem. The 
following procedure will void any Apple 
wari'antec. If you are inexperienced with 
soldering, desoldering or handling integrated 
cire-uils then get .some help with this fix. 

To begin, the case will have to be opened. 
Figure 1 . represents the back of the Apple He. 
There are 2 small plastic clips indicated at points 
1 , which will need to be carefully pryed open. 
.A medium flat headed screwdriver will be 
needed for the job. Gently pry ihese open, first 
on one .side then on the other. The second set 
of clips can be found by using the flatheaded 
screwdriver to pry the case apart at points 2. 
There are 3 clips in the groove between the 
smooth case bottom and the upper ribbed 
section. Gently pry in the groove to separate 
the upper and lower case. 

With the back off, the six Phillips headed 
screws on the bottom (four under the keyboard 
and two at the back by the handle) may be 
removed. The four remaining screws on the 
bottom hold the disk drive in the case. Remove 
them as well. 

Place the computer upright and gently pry 
the case apan along the spht around the side 
of the ease. Lift off the top. The keyboard may 
now be unplugged and removed from the board. 
Next, the disk drive may be unplugged and 
removed. Also, unplug the speaker jack. 

The motherboard is held in by about ten 
Phillips screws and these need to be removed. 
With all the screws out, the motherboard can 
be removed from the ease. 

Locate the 74LS251 chip at the right-rear 
of the motherboard. This is the chip that needs 
to be replaced. Figure 2. indicates the location 
of the 74LS25I chip. 
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With the motherboard out, the 74LS251 
chip must be tut out. A fine pair of wire cutters 
works well. Care must be tiiken not to damage 
other eomponenlsi on the board while cutting 
ihe chip out. When the chip is em out desolder 
the pins left in the board. Do not overheat the 
printed eircuit board by holding the soldering 
iron on the board too long. A mediLim Wattage, 
23 or MO, soldering iron should be used with 
a low-statie suction desolder tool as opposed to 
desoldcring braid. Alter the board is clean, 
solder in a low profile 16 pin socket. The new 
74LS251 chip may be in.serted observing the 
pin I location. The screened dot on the 
motherboard corresponds to pin 1 on the IC. 

Reassemble the computer in the reverse 
wrder It was taken apart. 

To test the repaired system, you may use 
this BASIC program. 
10 PRINT PDL(O). PDL(l):GOTO 10 

A llnal point relates to the cause of this 
problem. With the older Apple 11+ and Apple 
lie computers the game 1/0 port served a 
unitar)' purpose. However, wiih the Apple He 
the game port also serves as a mouse port and 
a switching operation sels (he function. On older 
Apples, plugging-in or unplugging an 1/0 
device would not ordinarilly cause any damage. 
By contrast, the Apple lie may be damaged by 
plugging- in or unplugging I/O devices with the 
power on. To avoid this quite tricky repair job, 
I would suggest not plugging-in or unplugging 
I/O devices with the power on if you are using 
an Apple He. 





Mike Neuliep 1 


Softkeyfor... 


Ring Quest 

Penguin Software 



The first thing I do after purchasing a disk 
is try to deprotect it. And the first step iti tiding 
to deprotecl is to see if the disk is in a normal 
format. I soon found that this was not the case 
because COPYA refused to copy. I used the 
nibble-editor from ("opy II + and found that the 
formatting was similar to that of other Penguin 
products. The data epilogs were changed from 
the standard DEAA to DAAA. All the even track 
numbers are formatted somewhat normally, but 
on the odd number tracks the data headers had 
been changed from the standard D5 AA 95 to D4 
AA 96. With this in mind we can set out to 
deprotect the disk. 

One easy way to gel a protected disk in a 
normal formal is have it read the strangely 
formatted disk and write in a normal format. 
Super iOB'^ RWTS Swap Controller depends 
heavily upon this. Another way to do it is to 
change the part of" Dt)S that reads so it will read 
in the protected format and write in the normal 



format. That's how I deprotected Ring Quest. 

|"^~~| Boot the DOS 3.3 System Master and 
run COPYA. 

run copya 

Ejc] 

70 
CALL-151 



I 2 I Now change tiie part of DOS that 
reads the disk so it'll read the protected disk, 
B934:C9 DA 
8990:C9 DA 

The old values were C9 DE for both of 
them. We changed them to C9 DA so we can 
read Penguin's altered data field epilogs. 

|_3_| Now tell DOS that the even tracks 
have a normal address header, 
B9S4:4A 49 6A DO EF 



I 4 I Clear the carrj' codes. This tells DOS 
that if you run inU) an error, then don't worry 
about it. 
B92S;18 60 
B942:18 60 

Bgee:is 60 



I 5 I Now run the program and copy both 
sides of the disk. 
D566G 



I 6 I When that's done sector edit side one, 

Trk Set Byte(s) From To 

%m- %m i'42 ] 18 



I 7 I Write-proteet both sides of the disk. 
If you don't, the program will refuse to show 
the graphics in the game and then self-destruct. 
Anyone wishing to discuss copy protection, 
in general, or anyone who has scored more than 
250 points on The Hitchhiker 's Guide to the 
Galaxy, can write me. I always blow myself 
up when putting the interface in the vendmg 
machine. Can anyone help? 



Larry D. Hough 



More Franklin Ace notes 

Protected lie utilities 

I share a subscription with a friend of mine 
and let me first say that I'm enjoying the 
magazine a little more each issue. 

After reading the last issue, my son and I 
were able to work with hjs Might and Magic 
characters and change them around. This was 
our first experience in working with the 
innerworkings of a program. It proved to be 
quite interesting. After workitig with this one 
program, it brought up another question, 

<2) I have a Laser 128 aiid would like 



to try and use the Apple lie utility disk that my 
son has for his machine. We both use the Copy 
II Plus that I bought when I purchased the Laser 
128; however, after seeing what can be 
accomplished with the various programs, I 
wanted to inquire about his utility disk. 

When 1 boot the Ik Utility disk, I get the 
following notation and then am unable to move 
anywhere. "The System Utilities program is 
designed to work only with the Apple lie." 

One thing that bothered me was the so- 
ealled software piracy . 1 didn't think that what 
T am trying to accomplish is in any way piracy. 
It's more a matter of being inquisitive and 
delving into the programming part of 
computing. 

Any comments that you could add would 
be most appreciated, 

A Does anyone hiow how to circumvent the 
protection on the lie utility disk. It .sounds a lot 
like the problem with ProDOS and the Franklin 
Ace computer. RDEXed 



Alan T. Zak 



Modification for. . . 



Super Boulderdash 



First Star 



A note on the Super Boulderdash soffkey. 
On my version of Super Boulderdash from First 
Star Software, the softkey in COMPUTIST #50 
worked — to a degree. 

Unfortunately, the graphics become 
scrambled up slightly and the game is pitiful 
to play. To solve this, you will need the 
following: 

■ Requirements 

D COMPUTIST #50 

n Super Boulderda.fh backed up from softkey 

in COMPUTIST, Issue KSd) 
LI Copy II Plus sector-editor 



Trk Set Byte(5) Frofr 



To 



^.$.0:1 S0C S00-02 4C 59:05 



IS 50 DD 



You may decide that this modification is 
not worth merit if you enjoy playing specific 
levels, I have discovered that levels K, M— P 
and possibly others do not work. The entry door 
just flashes, and Rockford does not appear. 

All in all, if you want graphics on Super 
Bouldeidash , then this mod is for you (as long 
as you can stand a few-' unplayable levels). 

A The best softkeyfor BouMerdasfi / c£ // is 
in COMPUTIST ill>%. Try it before you try any 
of the others RDEXed 
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Terry MacGregor & Joe Walters 



Softkey for. . 



Daisy Professional 

Stone House Systems 



The Most-Protected Award nominee! 

■ Rcquirenients 

D Dnixy v2.2 or Daisy v2.4 

n System Master 

D A slave disk with the HELLO program 

deleted. 
D A master disk with a hello program named 

DAISY which has been deleted 
P Copy II Plus 

Overview 



Daisy Professional is a very fine statistieal 
mathematics package, publislicd by Rainbow 
Computing, Inc., that runs on all the Apple 
family computers. It is written in Applesoft 
BASIC and assembly language and occupies 
most of a disk. 

The Applesoft programs provide overall 
program control and the user interface. 
Assembly language subroutines provide Daisy 
improved real-lime, computation and 
specialised disk I/O. 

Despite these specialized routines, Daisy 
still suffers from real-time performance 
problems. These problems can be virtually 
eliminated through the use of a hard/RAM disk 
and an accelerator card, Unfortun^itely , copy- 
protection prevents Daisy from being a better 
performing program. 

For this reason and to learn more about 
DOS 33. I undertook the deprotection of 
Daiy. 

While the program itself is probably of 
minimal interest to the reader of COMPUTIST, 
what I learned will be of significant interest. 

The copy -protection techniques employed 
by Rainbow Computing are worthy of the 
attention of any hacker worthy of the name. 

I spell out, in great detail, what happens 
at each stage of the game. In addition, I make 
available a great deal of disassembled and 
commented code. 



i 



The disassemhied code is too extensive to 
print but is included in the Library Disic that 
is associated with this issue RDEXed 

Back Ground 



Daisy's protection scheme turned out to be 
"synehroni7,ed tracks", nibble -count, self- 
modifying code (two versions), and checksum 



counts (again, two versions). As far as I know, 
the self-modifying code and the nibble-count 
techniques arc a first. 

I believe that Daisy' f, copy -protection is 
better than anything that has appeared in 
COMPUTIST over the last several issues. 

Initially, 1 thought this would be an easy 
job because 1 was able to make bootable copies 
using either Locicswttii 5.0 lev C or Copy II 
Plus 5.5 and specifying synchronized tracks. 
This idea was reinforced when 1 was able to 
make an ejTor free (but non-bootable) copy 
using COPYA from the DOS 3 3 sy.stem master 
disk. This demonstrated that no altered DOS 
marks hanky panky was gomg on. In retrospect, 
1 was only partially correct. 

As a starting point, 1 assumed that DOS was 
not involved (almost true) in the protection 
scheme. I decided to disassemble the two 
programs BLOAD'd (DAISY:PARM0 and 
DAISY:PARMI) and the one that was BRUN 
{DAISY:PARM2) by Daisy' i hello program. 
This turned out to be the right approach. 

The Chase 



DAISY:PARMI turned out to be data 
which couldn't be disassembled (wrong, stick 
around) so 1 moved on to DAISY :PARI^2. 

The first suspicious code 1 examined turned 
out to be (he standard methtxl specified by 
Apple to determine if you have an 80-column 
card (The method is documented in "Design 
Guidelines" which should be available, tor no 
charge, from your local Apple dealer). 

Continuing with my code-tracing, I 
discovered a copy-protection technique using 
values stored in page zero. Location SEC has 
$8D added to it. This location is then checked 
by Daisy to see if it i.s the same as the contents 
of $CF. If different, a transfer to $C600 (the 
PR^6 location) ensues. If this test passes, the 
boot process continues. 

Continuing with my code-tracing, I found 
that location $700© is modified from AD 00 E0 
(LDA $E0O0) to AD 40 E0 (LDA $EO40). 
Program execution continues to a point where 
the program performs a JMP (S7O0O), JMP 
(S70OO) is an indirect transfer which takes us 
to $40AD which is in the middle of the 
previously {oiAf^d DAISY :PARM1 . 

From here, there is another indirect 
transfer, JMP (S03FF). At this point Daisy 
capitalizes on the well-known 6502 hardware 
hug where the processor picks up the low byte 
of the destination from $3FF and the high byte 
from $300, rather than the high byte from 
$40©. 

At $30© DOS begins its vector table. The 
table contains (somewhat) fixed values. At 
location $3O0 is a JMP instruction which has 
an opcode of $4C while $3FF contains $FF, 
so we end up at location $4CFF (As a side 
note, version 2.2 oi Daisy will not work with 



any Apple using the 6SC02 processor. The new 
Daisy publishers (Stonehouse) corrected the 
problem iji version 2.4 by replacing the two 
indirect transfers with a direct transfer to 
$4CFF,) 

At $4CFF, I found executable code but was 
stymied on how it got there. As far as 1 can tell 
nothing has been loaded at $4CFF during the 
btwt process, except the DOS image that was 
later moved up in memory. My focus then 
shifted towards understanding how Daisy had 
placed executable ctxle at $4CFF. 

1 remembered COMPUTIST »5. In that 
issue was an article called "Getting On The 
Right Track." The author of the article 
recommended marking your disk drive cam so 
you could sec which tracks were being 
accessed. This seemed like a good idea, so I 
did it and then booted a COPYA version of 
Daisy. I chose this copy becau.se 1 knew it 
would fail to boot. 1 saw that tracks S0O, $02, 
$01, $13, andS00 were accessed during boot, 
at which time the boot failed. 

Getting smarter, I used the traek/sector map 
utility of Copy II Plus lo see what programs 
were on track $13. Holy Krakowicz!! Track 
$13, sectors S03, $©4, and $05 were busy (not 
free) and yet no program on the disk claimed 
them. 

Puzzled, I disassembled DOS B00T2, 
which is the RWTS and the code that moves 
DOS to its final resting place. I used the 
dissassembleofBOOT2, die Merlin editor, and 
a normal DOS listing and found out that a 
portion of DOS that was labeled "UNUSED" 
when compared to my disassembled copy was 
quite different. Looking more closely, 1 saw that 
the protection scheme placed an address into 
the RWTS control block that was for the 
"pointer to a client data buffer. ' ' The code then 
transferred to another unused hole in DOS 
where they finished setting up the RWTS 
parmlist to read track $13, .sector 503 into 
address $4C7©. RWTS was then called. 

Armed with this information, my next 
logical step was to use hispector/Watson to 
produce a BLOADable copy of track $13, 
sectors $03. S©4, and 505 with a loading 
address of $4C70. 1 then used Merlin to 
disassemble it. 



Track $13 Sector $03 



($4C70 — Executable Code) 

The first sector promptly stored "LDA 
j^$06" into the DOS-cold start routine. That 
is the instruction that normally lives there. 
Looking at the contents of that address before 
the write, I saw there was a JMP to the first 
DOS hole previously discussed. 

The protection scheme was not taking any 
chances, it was covering its tracks as quickly 
as possible. 
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Next the protection stheme changed the 
"'JMP to just read sector" into a RTS so that 
when the next sector was read in, RWTS would 
reiurti to the sector $03 code. When RWTS 
returned, a JSR to $6O00 ensued (track $13, 
sector $04), 

Track $13 Sector $04 



($6000 Executable Code) 

The $60OO code docs several self- 
modifications. The first instruction decrements 
(DEC) the first byte t)f the next instruction 
niaking it a valid INC instruction. Execution 
of this instruction turns it back into an illegal 
instruction. After that, program execution 
continue.s for a couple of instructions and then 
branches into the middle of a JSR, JMP. illegal 
instruction, etc. The trick here is to disassemble 
up to the BNE.'BEQ instruction and then take 
the next byte(s} as "who cares'.'" HEX values 
until \^e reach the destination of the transfer 
where we again start the disassembly. In some 
cases the HEX values arc truly "who cares." 
in other cases the branched over byte(s) are 
constants used by the program. 

This nonsense continued with little useful 
work except an EOR of a byte at location YY . 
This changed a RTS into a LDA as is shown 
in the program fragment below. 

LDV S$29 Loop counter 
LOOP TYA K to the A 

BCC XX Always 

HE); 20 This looks likeJSRS0059 

XX EOR $6000. V This decodes $S929-69FF 

STA S5000,Y using amoving i^ey. 

I NY the Y register (see loop). 

BNE LOOP 

TYA Zero to A 

BPL YY 

HEX S4C JMP $2960 

VY LDA %Hm 

The EOR's start at S6©29 and continue 
'tlirough S60FF. Looking at this program 
fragment, one sees that the protection scheme 
performs a conversion of track $13, sector $04 
data to executable code by using a "moving 
key" (the loop counter). 

This scheme is atypical; hence, rendering 
the Locksmith function that allows one to 
"cxclusive-OR" a number with the entire sector 
useless. 

The convened code was the "synchronized 
track" code f for which 1 had initially started 
looking. It turns out that it is only half way 
synchronized. When the protection scheme 
finds the wanted sector SOO, on track SO0, 
it goes into a mode where it merely reads the 
data field starting at the last nibble of the data 
prologue for 343 nibbles. At that point, it 
transfers into another loop where it keeps 
reading the data from the disk without checking 
for the presence of a nibble for 527/ts. It then 



looks one time for a nibble. If a nibble can not 
be found, then try again in 7/ts. If one is found 
either time, it is checked for the value C9 (test 
pass case). 

If it fails then it self destrucis all of memor>' 
except $C©O0-.$C(Z)FF and $0100-50 IFF by 
writing it full of S04"s. Finally, the protection 
scheme jumps to SFA62 which is the system 
reset routine where it will look as if power was 
just applied (because of $04 in the power up 
byte) and so we will boot the disk again. 

Assuming the test passes, we transfer back 
to the top of this routine ($6000) where we 
go through the whole mess one more time. 
However, remember that the second EOR 
sequence puts memory back to its original state. 
This in essence, covers up all remains of 
protection scheme code. When completed, the 
protection scheme falls out of the ECJR loop and 
executes a S60 (RTS) at location YY. 

Program execution resumes at the S4C70 
code which invoked the track $13, sector S04 
code. From here, the protection scheme toads 
in track $13, sector S05 into S560O and 
transfers there. 

Here's another observation gleaned from 
this code-tracing centers around the nibble 
checked for (C9). It is an invalid disk-nibble in 
that it has two occurrences of adjacent zeroes 
(1 100 1001) in the same word. The fact that 
this worked implies that the Apple disk drives 
are better than we have been toldf In the 
following code fragment the code protection 
scheme arrives at the sought C9 nibble. 

Register X contains the slot of the boot 
drive limes (*) 16 ($60). 
LOOP INY Y Is zero on entry 

CPY *J30 

EOR JC08C,X Strobecard for nibbles 

BCC LOOP Carry from CPY not EOR 

LDA $C08C,X mw for real 

BPL GETBYTE 
CKBYTE CMP SSC9 

BNE DEATH 

LDA $C088.X Turn off drive motor 

JMP $6000 Fromttie top 
GETBYTE NOP 

NOP 

LDA $C08C.X Last chance 

BM I CKBYTE Maybe success 
DEATH EQU * 

Track $13 Sector $05 



($5600 Executable Code) 

When the sector S04 code returns, the 
sector S03 code first perft^rms some magic with 
location $CF. The correct answer is 7B and 1 
have no idea why (see the assembly language 
file for track $13, sectors $03-05 for good 
guess). 

The sector three code then loads sector $05 
into $5600 and transfers there. The same old 
stuff awaits us. This lime, the first instruction 



is an ASL that enables a following ROR that 
puts it back to illegal. The same tricks of 
BNE/BEQ into the middle of instructions 
continue until we reach the EOR loop where 
we uncover a check sum -count routine that 
makes sure that the synchronized tracks routine 
has nol been trifled with. If the routine checks 
out okay, location $IE is set to 93. Next we go 
back to the top where the code is hidden once 
more and we fall into the RTS (ho hum) back 
to the sector $03 code. 

More Track $13 Sector $03 



Program execution picks up with the 
following track S13, sector SOS code which sets 
up constants. This will be used by subsequent 
programs to validate the boot process. 

LDA IIE Contains S93 

STA 197 

EOR KF 

STA JEC Contains SEB 

The program then zaps both DOS patches 
by copying disjoint DOS routines over them. 
The protection scheme then zaps memory from 
$4C70 through $4CFE. Following this, it then 
transfers back to the restored instruction 
(restored as the first action of the track $13, 
sector $04 code) in the DOS cold start routine. 

A little later the Daisy HELLO program 
will be executed and DAISY:PARM0 and 
DAISY-.PARMi will be loaded and 
DA!SY:PARM2 will be BRUN. As described 
in the verv beginning, $4CFF will be entered. 

The S4CFF routine will load track $02, 
sector $06 into S5600 and go there. This 
routine is an exact copy of the track $13, sector 
S05 code that performed a checksum-count of 
the synchronized tracks routine. The checksum- 
count, previously described, is then repeated. 
This is done to prevent one from defusing the 
code loaded from track $13, sectors S03 
through SOS. Assuming this second identical 
test passes, the protection scheme then returns 
to the $4CFF routine where we execute the 
following code: 

LDA $CF C($CF) = $78 (Magic HI) 
EOR ffSBD A = SCS 
CLC 

ADC SIE C(SIE) = $93 (Magic HZ) 
ETA $1B A^$5& 

The value of location SIB is a function of 
the two magic numbers and the constant BD. 
What does it mean? 1 don't know. I think it is 
a confiision factor (mine, not their's), under the 
assumption you can never discover the contents 
of $CF and $IE which would not allow you to 
form the contents of SIB. 

The program continues executing the 
following code: 

LDX S05- Number of pages to decode 
AA SEC 

LDA {WS) ,y Here we are decoding tfie 
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S'BC SCF program DAISY:PARM1 

EOR SIE- 
STA {S08),Y 
I NY 

BNE AA 
DEX 
BPL AA 

What tliii is doing is decoding 
DAISY PARMl using Iwo of the magic 
numbers ironi above. This is a different 
decoding technique than the one used twice 
before. This time, the EOR key remains 
constant. However, the value it woiks on is a 
tunetion of the magic number in $CF. After it 
finishes, it copies page $03 over most of this 
code and then returns to BASIC. 

Continual Copy-Protection Ploy 

Alter a successful boot of Da/sj i.s made, 
the protection scheme is continually active 
during program operation. This separate 
.scheme is put into place during boot. 

When run, PA/5r.-P/A^jW2>OKEs$3E7l 
(DAISY.-PARMl) into the ampersand vector 
address of page zero. This address will be 
entered by any Applesoft program that has an 
ampersand (&) as a command. Each of the 
DAISY:? progranis has an initial line of "& 
RESTORE" which transfers control to (his 
ampersand vecUir. If you look at several of 
these progran)s, you will sec the comment 
''restore variables." This is the method ZJt7/.y 
uses to pass variables between Applesoft 
programs. 

On entry, the job of passing variables 
between Applesoft programs is addressed. 
Right in the middle, page /.ero location $1B is 
checked to see if it contains 58. [f it docs not. 
a routine is entered that will pull (PL A) the first 
byte of the return address off of the stack. Then 
the code continues. This means that when an 
exit is made from this routine, program 
execution begins at the wrong address and will 
run wildly and unpredictably through memory. 

Continuing with the mind games, they 
check location $4F for non-zero in bits 7 
through 4, If it is non-zero, they will not kill 
you this time. Rest assured, these bits are /,ero 
on an initial boot. 

Flaws in Rainbow's Protection 

Three major flaws were discovered during 
my deprotection effoits. These were bugs not 
found during Rainbow's testing of the 
protection scheme. 

As you saw, they covered their tracks into 
the $4C70 code yet they never prevented me 
from messing with it. While messing around, 
I overwTote $4C70 code to see what the called 
routine returned in terms of page zero kx;ations, 
etc., writing that sector back and booting the 
disk one more time. 



Something prevented them from producing 
a real synchronized tracks protection scheme, 
which allow-ed almost any decent nibble-copy 
program to make a bootable copy. 

Finally, they busied sectors SO.?, $04, and 
%(/)5 of track $13 in the track sector map. If they 
would have left them idle, it would have .tail>;c,n 
me much longer to catch on. 

Commentary & Observations 



On Copy -Protect ion 

The silly part of this entire exercise is that 
Daisy is a mathematics package that depends 
very much on the paper documentation that 
accompanies it. If the disk was copy able by any 
copy progiam and one gave it to every Tom, 
Dick, & Harry that came down the pike, they 
wouldn't know what to do w-ith it. 

The annoying part is that I could copy this 
program using the first two copy programs of 
choice. Copy II Pius and Locl^smith 5.0. 
However, I still could not move it to a hard or 
a RAM disk where it would do me the most 
good. I think the message that needs to be 
transmitted to the providers/ow'ners of softw^arc 
is that "thieves will always steal your wares 
while honest owners \yill suffer your copy 
protection. 

The Softkey 



As always, use a copy of the original disk 
or be prepared to light a candle in the name ol" 
the late, lamented original! In fact, use a copy 
made with your favorite copy program. The 
copy will not boot; however, that is not a 
problem. 

ri I Boot a DOS 3,3 System Master disk. 

I 2 1 Remove the DOS 3.3 System Master 
and insert a blank disk. 
INIT DAISY 
DELETE DAISY 

This is a slave disk. The DOS from a slave 
disk, when it is booted, goes directly to its 
normal location lor a 48K Apple without 
screwing up the memorv- in between .$9600 and 
$800. 



[ 3 I Repeal steps one and two for another 
blank disk (use the back if you wish). 



I 4 I Remove the 2nd slave disk and 
reinsert the DOS 3.3 System Master. 

BRUN MASTER CREATE 



I 5 I 'When the drive stops, put the second 
slave disk from above in the drive and follow 
the screen prompts to turn it into a master disk 
with a hello program called DAiSY . Be sure 
you label these disks correcdy as slave and 
master. The master will become the liberated 
Daisy, the slave will help us do our job. 



From here on master will refer to this 
disk and not the DOS 3,3 system master. 

I 6 I Remove the master disk ^nd put in the 
copy of Daisy. 

LOAD DAISY 

102 POKE 27,88: POKE 30,147 :POEE 207,120 

:POKE 21B,147: POKE 236,235 
SAVE DAISY 

When the disk is booted the POKE'S put 
the magic numbers generated by the copy- 
protection scheme into memory for any 
subsequent programs that rnay wish to check 
for them, 

I 7 I Using a program, such as Copy I! 
Plus, find the start address of DAISY:PARMI 

and it's length. My version loads at $3E7I and 
is $3A3 long {xx & yy). 

I 8 j Using a sector-editor, find A9 01 SD on 

track SI 3. sector $03. Change these bytes to 
4C4I 9E. This causes the initial copy -protect ion 
steps- to be bypassed. 

[ 9 I Next Hnd A2 00 8E and change these 

bytes to 4C 27 4D This jumps over the final 
checksum-check. 

r 10 I Find 10 F7 60 and change these bytes 
to 4C 59 FF. This will cause a jump to the 
monitor when the program DAISY.PARMI has 
been decoded. Finally, write the sector back to 
track S13, .sector S03. 

I 11 I Boot the copied protected disk and 
wait for the monitor prompt (*). 
DAISY.PARMI is now decoded in memory, 

r 12~| Place the slave di sk (N OTE: slave) in 
drive 1 and boot it with fi l- '1*1 



I 13 I Wheri the drive stops, put the master 
disk in the drive, 

ESAVE DAISY:PARM1, A$jsx, LSyy 

Where xx and yy are the loading and length 
attributes obtained in step 7, 

I 14 ] Copy all files except D/l/5rP/l/iA// 
to this disk from the protected disk. You are 
now done with the protected disk. Put it away 
in a safe place. 

r 15 I Use your sector-editor on the nearly 
liberated disk to find the byte sequence 6C 00 
70 for Daisy 2.2 and 4C Ff'^C for Daisy 2.4. 
Change the first byte, (5C/4C) to 60 and' write 
the sector back. The file is DAISY:PARM2 if 
your sector-editor has file- following 
capabilities. You are done. 

Boot your liberated disk 



Moving Daitiy to a Hard/RAM disk is left 
as an exercise to the reader, as is the 
replacement of normal DOS with a speed up 
DOS of your choice. Hint, Djvers(-£>05 almost 
always works on anything! 
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Review of the Copy Protection 

There were six different copy protection 
techniques used to protect Daisy. 

The combination synchnmi/.cd track, 
nibble count routine is the primary protection 
scheme. The heart of this routine cannot be 
found using a sector editor since the code is 
"hidden" until the EOR loop uncovers it. 

If you would somehow circumvent the 
nibble count routine the p)an was for the second 
nibble count routine to cateh on and reset in a 
totally differenl way from the SYNC tracks 
routine, thus confusing you even more. 

If you remove all the code on track $13, 
sectors $03 through $05 and track $02 secior 
$06, the absence of ihe "magic" numbers in 
page zero locations would be detected by 
DAISY:PARM2 which then branched to 
jiCbOO which causes the disk to reboot. 

If you bypassed those checks, the program 
DAISY:PARM} would still be encoded 
(garbage) and would not run. 

If you fixed the above problem (probably 
the way we did), DAISY:PARM} would 
discover the missing page zero magic number 
and you would boot once more. This time the 
cause of the boot would be very hard to discover 
since you would transfer wildly on exit. 

Finally, the "magic" numbers generated 
during the boot process are probably checked 
for by crucial programs other than 
DAISY:PARM1 during program execution. 
This is why I took the chicken's way out and 
put them into the POKE's in the hello program 

All in all, becau.se thi.s protection used six 
different copy protection techniques, I would 
have to give this protection scheme a lO (or 
zero, depending on where you stand on this 
issue). 



So Bud, I hope you keep reading and enjoy 
the mag for what it is. 



Edward Teach 



Attn; Bud Myers. 

Since I submitted the last sottkcy 'tor Awwxi 
Maker Plufi, I think I should be one of the first 
to comment on the letter from Bud Myers, 

Bud, you have mis.sed the whole point of 
COMPUTIST. The idea is the sharing of 
information, not simply deprotection. 

For example, read the other articles on page 
32 of COMPUTIST ^52. What you will find 
is that the softkeys for Color Prim Shop and 
Empire I & II did not work for everyone. What 
they arc saying is while the specific patches did 
not work, try this different way. 

Further, while my article looks like I was 
stressing that the other softkeys did not work, 
the emphasis was supplied by the RDEXed. Is 
it so unheard of that a software company might 
vary the protection a bit every 10,000 disks 
or so? 



Bud Myers 



My apologies for my cranky tetter 
regarding copy-protection removal which you 
published in RDEX for February. My thanks 
for Mr. Teaeh's technique published on the 
same page as my letter. It works like a charm 1 
At last 1 can allow Award Maker Plus lo 
circulate, secure in the knowledge that when 
(not it) something happens to the working copy, 
I can quickly provide another. 

The reason 1 need to deprotect Word Attack 
is that, against my better judgment and all 
common sense, I allowed a teacher to sign out 
the mastei' copy. She ruined it. She is willing 
to pay for a replacement, but unless and until 
I can back it up it seems futile to allow her to 
do so. 

Could you ask your more advanced readers 
to provide the rest of us with more methods of 
backing up protected programs, whether the 
backup process removes the protection or not? 



i. 



Mr. Meyer's letter arrived a few days 
before the influx of answering mail. Many of 
the replys were somewhat har.'ih. I thought that 
printing the Award Maker softkey right after the 
original letter was sufficient answer hut many 
of you thought otherwise. Thanks Bud far 
shaking up otir readers and reminding them to 
write. J hadn 'l heard from some of them in quite 
a while. A little dissention can do wonders for 
the old blood pressure .,.,., , RDEXed 



Charles Taylor 



Softkey for.. 



Green Globs & Graphing Equations 

Sunburst 



■ Requirements 

a Super lOB 

n Swap controller 

n Initialized disk (no hello) 

This can be deprotected by using the swap 
controUei' and Super lOB, copying tracks 3-22 
to a disk mitalized with HELLO t . A previous 
COMPUTIST soflkey stated that the swap 
controller wouldn't work with 1986 Sunburst 
programs but it works with this one. 

The swap controller is used so often maybe 
you should consider putting it on the inside of 
the front cover with Checkbin, etc. 



I 1 I Bool [he disk and enter the monitor 
(reset or whatever), 

I 2 I Move the RWTS to a safe place. 



19ee<B300,BFFFM 

r 3 [ Boot a slave disk and save the RWTS 
to your disk with COMPUTIST stuff 

C600G 

BSAVE RWTS.SUNBUHST, A$19eO, LSSOO 



I 4 I Load and merge the sw'ap conti'oller 
wlh Super lOB thcu make sure that line lOlO 
of the swap controller reads TK=3 and not 
TK=0 and make sure that line 10010 
BLOADs RWTS.SUNBURST. 



I S [ Copy the program disk to a disk 
initialized with HELLO. 

Bug in the Softkey for... 



Masquerade 

Phoenix Software 



There is a bug in the Masquerade softkey 
(COMPUTIST #35, page 25) that I don't recall 
seeing a correction for: 
shown as should be 

9S2:A5 952:A5 

942:09 942:09 

945:09 945:05 

A few more comments on this crack: You 
can use COPYA to convert ihis disk to normal 
formatting for the first part of the softkey. (I 
had trouble with the Super lOB controller.) 

I 1 I Modify DOS to accept a D4 or a D5 in 
the address prologue and to ignore epilogues 
and checksums, 

CALL -151 

89S4:4A C9 6A DO EF 

6942:18 



I 2 I Insert the disk widi COPYA then load 
and modify COPY.OBJ0 to stop copying after 
track Sll. 



BLOAD COPY.OBJO 

3A1:18 

302:12 

35F:12 

I 3 I Now wc can load COPYA and run it. 

LOAD COPYA 
RUN 80 

This modified version oi COPYA will quit 
when it gets to track $12, Note that the changes 
in step 2 are to COPY.OBJO in memory, so 
you have to load COPYA and run the line after 
70 to keep COPYA from reloading 
COPY .OBJ0 dwd undoing your work. Changes 
to SB954 and $B942 are to the memory image 
of DOS so be sure to reboot when you are 
through copying. 
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Softkey for. . 



Expedition Amazon 

Penguin Software 



.Softkey for. . 



Coveted Mirror 

Penguin Software 



■ Requirements 

P Two double sided blanks 
p DOS 3.3 System master 
n Apple II series 
n Program disks 

D Copy II Plus or some utility for changing 
boot programs and copying DOS. 

These two excel lent programs from 
Penguin are protected and deprotectcd by 
similiar schemes. The proteetion is the usual 
Penguin protection: the first byte of the address 
prologue alternates from D5 on even tracks to 
04 on odd numbered tracks. This is easily 
defeated by using the method of Robert Muir 
in COMPUTIST ^38. 

Use FID from the system master to copy 
the tiles from the boot side of Expedition 
Amazon and use COPY A to copy the second 
side of Expedition Amazon and both sides of 
Coveted Mirror. 

Coveted Mirror has a slight secondary 
protection. It normally runs SETUPA as the 
boot-up prograiTfi. .SETUPA then rtins SETUP. 
We circumvent that by running SETUP as the 
boot-up program. 

For.., Expedition Amazon 



I 1 I Boot the DOS 3.3 system master. 

I 2 I Place a blank disk in the drive. 
FP 

INIT HELLO 
CALL-lSl 

B9M:4A C9 6A DO EF 
B942:18 

3Dec 

I 3 I BRUN FID and copy all files from the 
boot side to the initialized disk. 



1 4 I Run COPYA and copy the other side 
of the disk. Don't reboot. 

For... Coveted Mirror 



I 1 I Without rebooting, run COPYA and 
copy both sides. (For some reason EID would 
not make a working boot side.) 
RUN COPYA 



I 2 I Copy DOS from the System Master 
or your favorite fast. DOS to the boot side of 
the copy. 



I 3 I Change the boot-up program to 
SETUP. {I used Copy !! Plu.s for steps 2 and 3.) 

t Softkey for. . . 



Bouiderdasii Construction Kit 

Epyx 



The protection on these two is identical to 
Street Spon.s Baseball, COMPUTIST #50, 
page 36, 

A.P.T. for... 



Expedition Amazon 



Customize Your Expedition 

One of the many advantages of unprotected 
software is that one can make changes to the 
program. Since Expedition Amazon is a lengthy 
and difficult game, I have developed some 
APTs. 

The adventurers' progress is stored in two 
text files, EXPA and EXPB, depending on 
whether you are expedition A or B. Two other 
text files appear to be back-ups. (£%P/1£%R4 
and EXPBEXPB) Accordingly, they can be 
loaded into a word -processor and changed. 

The word-prtJcessor must be one that reads 
and writes text files. Applewriter will do just 
fine. The important thing is money and levels. 
Don't overdo it or the game will crash. 

The table below will a.ssi.st you in 
customi;;ing your expedition. 



Field Assistant 


1 


1 for Alive or O for 
Dead, I think 




9 


Level (LVD 




7 


Energy Level (EL) 


Medic 


1 






9 


LVL 




8 


EL 


Radio Operator 


1 






9 


LVL 




8 


EL 


Guard 


1 






9 


LVL 




8 


EL 




11 


Hoursi 







Days 




1657 


Treasure Value 




1 


Sectors Mapped 


179117 


Money 




229 


Sq Meters Mapped 











8 


Med Kit 




2 


Tools 




2 


Lamp 




1 


Battery 




2 


Rope 



4 Mosq Net 

1 Short Wave 

1 Liiran 

1 Auto Rifle 

1.^7 Bullets 

1 Grenades 
4 Food 

2 Boat 
O0©00(it600000O Sectors visible 
0000000000000 (the first one is fully 
0000000000000 mapped 

Softkey for... 



General Cliemistry Disk 08 

COM Press 



■ Requirements 

C Super lOB 1.5 

r: Apple II 

C 1 blank disk side 

G DOS 3.3 System Master 

When 1 first got this program I went to my 
COMPUTIST Appleworks database and found 
a softkey in COMPUTIST if 29. Unfortunately, 
the protection discussed in that softkey was 
completely different than the protection on my 
version. 

After scanning a few tracks with the Copy 
n Plus nibble editor, I realized that the 
Chemistry disk had the same format as Ultima 
IV. I tried Super lOB with Mike Roetmans' 
Ultima IV controller (COMPUTIST Kt^, 
correction in COMPUTIST iS'32) and I was 
rewarded with a working copy withotit having 
to make sector edits. 



I 1 I Boot the DOS 3.3 system master. 
I 2 I Put a blank disk in the drive and type: 
INIT HELLO 



3 I Install diis controller in Super lOB 1.5 



and run it. 



Controller 



1000 REM GENERAL CHEI^ISTRY ^8 

1010TK = 3:LT = 4:ST = 15;LS= 15:CD = WR 

1020 POKE 4740S.24: POKE 47406,96: POKE 

47497,24: POKE 47498.96 
1030 POKE 47329 , 3 : Tl = TK : GOSUB 490 : GOSUB 210 
1040 GOSUB 190: GOSUB 510 
1050 TK = TK + I : LT = LT + 1 : IF PEEK (BUT) < MB 

ANDTK< 35 THEN 1040 
1050 POKE 47405,208: POKE 47405,19, POKE 

47497,208: POKE 47493,183: POKE 

47829,213: GOSUB 230 
1070TK = T1.LT = 35: GOSUB 490: GOSUB 510: IF 

PEEK (TRK) = LT THEN 1090 
1080 TK = PEEK (TRK) : ST = PEEK (SCT) : LT = TK + 1 ; 

GOTO 1020 
.1090 HOME : PRINT '■COPYDONE,=D0S''NOT°C0PIED, '' 

: END 
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5000 DATA 213 


170,181 






5010 DATA 215 


170,151 






5020 DATA 213 


170,150 






5030 DATA 213 


170,151 






5040 DATA 215 


170,150 






5050 DATA 215 


170,151 






5060 DATA 221 


170,158 






5070 DATA 221 


170,159 






5080 DATA 213 


170.181 






5090 DATA 223 


170.158 






5100 DATA 223 


170.159 






5110 DATA 221 


170,158 






5120 DATA 221 


170,159 






5130 DATA 223 


170.158 






5140 DATA 223 


170.159 






5150 DATA 213 


170.150 






5160 DATA 213 


170.181. 






5170 DATA 213 


170.151 






5180 DATA 215 


170,150 






5190 DATA 215 


170,151 






5200 DATA 213 


170,150 






5210 DATA 213 


170,151 






5220 DATA 215 


170,150 






5230 DATA 215 


170,151 






5240 DATA 213 


170,181 






5250 DATA 221 


170,158 






6260 DATA 221 


170.159 






5270 DATA 223 


170.158 






5280 DATA 223 


17.0,159 






5290 DATA 221 


170,158 






5300 DATA 221 


170,159 






5310 DATA 223 


170,158 






5320 DATA 213 


170,181 






5330 DATA 223 


170.159 






5340 DATA 245 


170,182 






5350 DATA 245 


170.183 






5360 DATA 247 


170,182 






Controller Checksums 


1000 - 


356B 


5140 


- S59D2 


1010 - 


3189 


5150 


- seF2A 


1020 - 


C562 


5160 


- SAFA5 


1030 - 


545E 


5170 


- S8041 


1040 - i 


DDB4 


5180 


- J0796 


1050 - 


A5C8 


5190 


- S1259- 


1060 - i 


044B 


5200 


- S95A5 


1070 - i 


B732 


5210 


- S8E5D 


1080 - i 


045C 


5220 


- SIOBE 


1090 - 1 


0EB7 


5230 


- S4CFD 


5000 - i 


47E9 


5240 


- SEAF8 


5010 - ] 


C5B9 


5250 


- S3B74 


5020 - 


8750 


5260 


- SF464 


5030 - 


0BA3 


5270 


- S35E1 


5040 - 1 


0D51 


5280 


- SE4C4 


5050 - 3 


8BAD 


5290 


- $598C 


5060 - 


O0F5 


5300 


- S7A80 


5070 - i 


397D 


5310 


- S67A1 


5080 - 3 


CC35 


5320 


- $2132 


5090 - S 


96F7 


5330 


- $5F01 


5100 - S 


4E87 


5340 


- J0EF1 


5110 - J 


58CC 


5350 


- $9339 


5129 - 5 


A176 


5360 


- JB6AC 


5130 - 5 


0ASD 







Softkey for. , 



Zero-Gravity Pinball 

Avant-Garde Creations 



■ Requirements 

a MUFFfN (from DOS 3.3 system master) 
Zl Formatted disk with ai least 173 free sectors 
D Apple II (48K or more) 

Zero-Gravity Pinball is a eomputer pinball 
game with a new twist — the ball will eontinue 
in the direction it is hit until it flits something 
else. There is no tendency to return to the 
bottom of the screen. Ten flippers along the 
sides of the screen are selected with a paddle 
control, one at a time. The ball is kept from 
going out the top and bottom of the screen by 
means of a force field (controlled by the 
keyboard and space bar.) If this sounds 
complicated, it'.s because it is. 

At first glace the copy protection seems 
simple. It is 13-sector with the address and data 
epilogs changed from DEAA to DFAA. Copying 
this disk with any program that attempts to copy 
the whole dislc W'ill result in numerous read 
errors, however. This is because the sectors not 
containing data are formatted without data 
headers. 

I decided that a modified MUFFIN was the 
way to go. I loaded MUFFIN and searched it 
for the byte DE, then changed DE to DF. This 
modified MUFFIN was now able to read the 
files on the Zero-Gravity Pinball disk and write 
to a standard foraiatted disk. 



I 1 I Boot DOS 3,3 system master and load 
MUFFIN. 

BLOAD MUFFIN 



I Z I Enter the monitor, 

CALL-lSl 

1A56:DF read altered data epilog 
1AB2:DF read altt^red atidres.\ prolog 
803G stam MVFFIN 



I 3 I CopyalIfilcstdafonnatteddi.sk. 
Softkey for. . . 



Spy's Demise 

Penguin Software 



■ Requirenient.s 

D 1 blank disk 

D DOS 3.3 .system master with FID 

Mr. Pollak's boot code trace for Spy's 
Demise was interesting, but it wouldn't work 
on my disk. 1 do thank Mr. Pollack for the 
information in his article (COMPUTIST n5, 
page 7). 

Since Spy's Demise could be cataloged 



after it was converted to standard DOS, I used 
FID to copy the files. Then I loaded two of the 
files into memory and confinued wilh (he code 
entry in Mr. Pollack's softkey. 

[ 1 I Bt)0t the system master. 

[ 2 I Place a blank disk in the drive. 
POKE 40514,52 allows binary l\ello 

INIT SPY'S DEMISE 



I 3 I Place the system master in the drive. 
CALL-151 Enier the monitor 

B954:4A C9 6A DO EF read penguin DOS 

B94Z:13 ignore epilog errori 

BRUN FID 



r4~~| Copy TITLE.PIC and DEMISE to tfi^ 
initialized disk then boot the system master disk. 

I 5 I Place the copy in the drive. 
BLOAD TITLE.PIC 
BLOAD DEMISE 



r 6 I From here on we use Mr, Pollak's 
softkey. 
CALL-151 

3F04:AD EC B7 SD 
3F0S:EE SO AD ED B7 8D EF 80 
3F10;AD 5(9 CO AD 52 CO AD 55 
3F18:CO AD 57 CO 4C 00 60 
SEOOlOO 

SE0K8E00.SEFEM 
8004:20 00 BD 60 
BSAVE SPY'S DEMISE, AS3F04, L$4FFB 



Softkey for... 


Roadwar2000 

Strategic Simulations 


Softkey for... 


Wizards' Crown 

Strategic Simulations 


Softkey for... 


Roadwar Europa 

Strategic Simulations 


Softkey for... 


Kids on Keys 

Spinnaker 



■ Requirements 

9 COPYA (from DOS 3.3 system disk) 
U 1 blank disk 

Roadwar 2000 is sort of a combination 
sequel to the computer gamc/^uftx/we/and the 
Mad Max movie series. You have to chase all 
over the country, seavanging for food, gas and 



Aptil 
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other supplies on your quest to find an antidote 
to the national epidemie. 

The copy -protect ion is identical to the 
Wizard'^ Crown protection (alternating D5 and 
D4 in the address prolog and non-standard 
address epilogs. (See COMPUTIST #42.) 
Being too lazy to type in the Wizard's Crawn 
controller. I used COPYA with a few DOS 
changes to de protect this ganne, 

I 1 1 Boot your DOS 3,3 system master and 
alter DOS. 

CbU'151 

B9Mr4A C9 6A DO EF allow D4 or D5 in addr 

prolog 
B9SS:18 60 ignore addr epilog erron 
3DQG 
RUN COPYA 

This procedure also copies Wizard 's 
Crown, Rmdwar Europa, and Kids on Key <i by 
Spinnaker. 

Soflkey for... 



Rendezvous 

Peachtree 



■ Requirements 

a Apple II 

D One hlank disk side 

D COPYA 

D Program line editor (optional, but 

useful) 
[I A way into the monitor 



very 



The two previous softkeys for Rendezvous 
were not effective on my version, so 1 was 
forced to do my own deprotection. Rendezvous 
l.O can he copied by COPYA and the files are 
listable from normal DOS. 

The copy begins to boot, but the screen 
clears and the copy reboots after the rocketship 
comes on the screen. Since rebooting is usually 
caused by a JMP C60O somewhere on the disk, 
I scanned the disk with my Copy 11 Plus sector 
editor for the machine code 4C 00 C5 (JMP 
C600). 

To my delight, the sector editor found the 
JMP C6O0 on track I A, sector B, along with 
the following code: 



1C75 A5 34 


LDX34 


1C77 BD 8C C0 


IDA C08C 


1C7A 10 FB 


BPL 1C77 


1C7C C9 C3 


CMP SC3 


1C7E D0 F7 


BNE 1C77 


lCe0 A9 09 


IDA $00 


ice2 S5 m 


STA 00 


1C84 85 01 


STA01 


1C86 BD SC C0 


LDA C08C 


IC89 10 FB 


BPL 1C86 


1C8BC9C3 


CMP $C3 


1C8D F0 14 


BEQ 1CA3 


1C8F E6 00 


INC 00 



1C91 D0 F3 


BNE 1C86 


1C93 E5 01 


INC 01 


1C95 D0 EF 


BNE 1C86 


1C97 4C 00 C6 


JMP C600 


1C9A EA 


NOP 


1CA2 EA 


NOP 


1CA3 A5 01 


LDA 01 


1CA5 C5 36 


CMP 36 


1CA7 D0 EE 


BNE 1097 


1CA9 A5 00 


LDA 00 


1CABC5 37 


CMP 37 


ICAD 90 E8 


BCC 1C97 


ICAF C5 38 


CMP 38 


ICBl 60 E4 


BCS 1C97 


1CB3 60 


RTS 



I thought all 1 had to do was replace the 
JMP C60O with a RTS (return) lo have an 
unproiected copy. Wrong! It rebooted anyhow, 
and there was no other JMP C6O0 on the disk. 
1 experimented with the ct)de in this area to no 
avail. It was certainly the protection code, but 

I would have to get around it in another way. 

The Catalog and Track-Sector map of Copy 

II Plus revealed that track lA, sector B 
(containing the reboot code) was contained in 
the binary Hie '■RGO'\ which loaded at 
location JIBOO. and is $O4F0 in length. 

The basic program RENDEZVOUS 
BLOADi R3DH, BLOADi RGO. then CALLs 
7168, which is a jump to S1CO0. (#7168 = 
SI COO) 

Eliminating this CALL solved the 
rebooting problem, but the program hung-up 
after the main menu. Apparently, the code at 
location $IC00 did something besides a disk 
check. 

I studied the code beginning at $1000 and 
found the following: 



1C00 


A2 00 LDX #$00 




1C02 


BD00 1BLDAS1E00,X 


load accumwith 
page $IB00 


1C05 


9D00 0ASTA$0A00.X 


store It at page 
S0A00 


1C08 


EB INX 




1C09 


D0 F7 BNE J.1C02 




1C0B 


A9A2 LDABSA2 


load accunulalor 
withA2 


1C0D 


BD 00 08 STA $0809 


stcjre it at $800 


1C10 


A9 70 LDAi($70 


load accumulator 
with 70 


1C12 


8D 01 08 STA $801 


store it at $801 


iei5 


A9B5 LDAfJBS 


load accumulator 
withBS 


1C17 


8D02 08STASS02 


store it at $802 


ICIA 


D0 01 BNE SICID 




1C2B 


00 48 BNE$1C75 


branch todisk 
ctieck 



Note that the LDAs and STAs arc changing 
some machine code around $8O0. Back to the 
catalog, the only program loading at $8O0 was 
R3Dh. R3DN, therefore, was the file being 



modified by the CALL 7168. After the disk 
check and the changes were made to R3DH, 
the menu runs. R3DH was called by CALL 
2048 (#2048 = S8O0) in the LIFTOFF basic 
program (and others) after the main menu. Now 
il was clear that 1 had to get the modified R3DH 
onto my COPYA copy. Then the CALL 7168 
in the file RENDEZVOUS could be eliminated, 
along with the disk check. 

The rest was straight- forward. 1 booted my 
original disk. When the main menu came up, 
I reset into the monitor with my Replay card 
and BSAVKd R3DH, onto my COPYA copy. 
The R3DH that 1 saved was the modified 
R3DH, since I had allowed the program to hoot 
past the disk check and R3DH changes, to the 
main menu. Then I loaded the RENDEZVOUS 
file and eliminated ihe CALL 7168 from line 2, 

Lacking a means of resetting into the 
monitor, you might try making a nibble copy 
of Rendezvous, loading the basic program 
HDU-WARE. and removing the three pokes 
which prevent the normal reset. These are the 
POKES 1010. 1011. and 1012 in line 1. Then 
you can reset into the monitor with the reset 
key . 1 had some difficulty with I/O errors when 
doing this, however. 

Cookbook style 



I 1 I Use COPYA to make.: a copy of 
Rendezvous. 

I 2 I Unlock and delete R3DH from your 
copy. 

UNLOCK R3DH 
DELETE R3DH 

I 3 I L'nlock and load Rendezvous. 

UNLOCK RENDEZVOUS 
LOAD RENDEZVOUS 



: 



HH Rditline2. Remove the CALL 7 168. 
HH Save the modified ^iWZ>£Zrat/5, 



SAVE RENDEZVOUS 



I 6 I Bool Ihe original and reset into the 

monitor at the main menu. 



I 7 I Enter BASIC with: 
3D0G 

I 8 I Put your copy into the drive and: 
RSAVE R3DH, A$8(K9, L$12FF 

The following are optional .steps. 



I 9 I If you haven't already done so, you 
will probably want to remove the POKES 
lOlO, 1011, and 1012 in EDU-WARE to 
allow a normal re.set. 



r^Ol Whilei!£iV£)£'ZVOt;S is in memory 
(step 4) you might as well delete the BLOAD 
RGO It isn't used anv more. 



I 11 I You can also delete RGO during step 
2 if you also perform step 10, 
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Jeao Philippe Cuniuet 



DOS FOR MAKER 

DOS ROR MAKER ( a.k.n. DHM) is a 
short program used lo protect data on disks. 
DEM will modifv DOS 3.3 so that the RWTS 
will exchisive-OR (EOR) all data read tiom or 
written to the disk with any he\ value you have 
ehosen. It's a simple way to code data on disk 
for protection. 'l"he data in ineiiior>' is the same 
as always but on the disk, it's very different. 
Catalog a DEM disk with normal DOS to see 
what I mean. The disk format is normal and 
ean be eopied with COPYA or any other normal 
disk eopier. Only the data is encoded 

The heart of the coding routine is a EOR 
#$xx command where x\ is a hex value 
(location $BCFg:xx) from S00 to SFF, A value 
of $00 is for normal DOS since EOR-ing with 
$00 doesn't change the original value, 'Vou 
could also modify the code into whatever 
complicated routine you want. 

The main routine is put in DOS at location 
$BCDF'BCFF (normally unused). The RWTS 
IS patched at SB7B7 to call SBCDF ($B7B7;20 
DF BC instead of SB7B7:20 00 BD). Another 
patch is made to DOS at $B799 so that if you 
u.se the INIT command, the DOS won't be 
EORed when written to the disk ($B799:2C') Ot) 
BD instead of SEim-.im B5 B7). 



£ 



You may have ionw problems with )hese 
patches depending on the equipment in your 
system. Other programs sometimes take 
advantage of the ' 'unused areas ' ' in DOS to 
store their own routines. Some hard disks patch 
till' jump code at $B7B7 and are adver.se to 
sharing. Also, patching tl\e IN IT code to bypass 
the normal entry at $B7B5 may not be a good 
idea. While it is necessary to turn of the 
encoding during an INIT, calling the RWTS 
direct (Instead of thru $B7B5) wUl not set the 
interupt disable. If any inlcrupts are generated, 
they will interfere with the write routines which 
are timing dependent not to tnenliwi what 
terrible things may be happening to your hard 
drive if it dldn 't intercept the INIT call at 
$B7B5. A better method would be to remove the 
patch at $B7B7 for the INIT or another 
subroutine {In some other "unused area" of 
DOS) that sets the EOR byte to $00 and 
restores the original value afier the INIT is 
completed : , ., RDEXed 

Just enter and save the BASIC program, 

SAVE DOS EOR MAKER 

When mil the program wilt install the patch 
and ask what value you wish to use to encode 
data. When the program exits by printing "DOS 
EOR READY", all the patches will be in place. 



Disks initialized now can be used as any DOS 
3,3 disk but you can't CATALOG it from 
another DOS 

To transler tiles from one DOS to another, 
you should: 

I 1 I Select the source DOS. 

I 2 I Load the file into memory. 

I 3 I Select the destination DOS. 

I 4 I Save the file on the destination DOS. 
If your file is a "A' file (BASIC), it's very 
easy. If it is a binary file (type 'B'), you have 
to know-' the starting address and the length of 
It before you .save it. To find that, type, after 
loading the binary file: 
CALL-151 
AA60.AA73 

Locations AA6t3.AA61 will give you its 
length (low byte first). Locations AA72.AA73 
will give yon its starting address ( II ). Then. 
.select destination DOS and type: 
BSAVE filt'iKinie, AS Add ten, L$ Lvi'ltt 

if your file is a *T" file, you will have to 
play with the READ and WRITE commands. 

Of course, you could modify the Super lOB 
program so that the disk in Drive 1 is read with 
a normal DOS (POKF 48377.0) and the data 
is written in drive 2 encoded (POKE 48377, .tx). 
Good luck protecting your data, 

DOS EOR MAKER 

10 TEXT : HOME .DI = CHRI (4): INVERSE : PRINT 

"DOS-EORllAKER" : PRINT "JPH'CUNNIET" : 

NORMAL 
2aFORX = lT0 33:READA: POKE 48350 + X. A: NEXT 

: POKE 47032.223: POKE 47033.188: POKE 

47002,0. POKE 47003. 189 
30 VTAB 12: PRINT "Z£RO'=-'NORMAL"DOS" ; PRINT 

"{D.EFAULrvALUE=" PEEK (48377) ")" : VTAS. 

11 : PRINT "EOR^VALUE'FOR'DOS^( 1/255) : " : : 

INPUT A$:A = VAL (AS): IFLEN{AJ)< I THEN 

A=PEEK (48377) 
40 IF A > 255 THEN 30 
50 POKE 48377. A 
60 PR I NT : PR I NT "DOS'EOR'REAOV ! " : PR I NT : PR I NT 

"TYPE . ^P0KEM8377 . 0"FOR°NORMAL'DOS'OR" : 

PRINT : PRINT "POKE'48377 . " PEEK (48377) 

"■■■TO'REST0RE'E.NC0DIN0" 
70DATA132. 72. 133. 73. 160, 8. 177, 72, 133. 

6. 200. 177. 72 133. 7. 32. 244. 188, 32, 

4. 189. 160.0, 177,5.73. 120, 145.6.200. 

208, 247. 95 

Checksums 

10 - ?B8C3 50 - JABCe 

20 - JF715 50 - 12174 

■30 ' S58B9 70 - $51E5 

40 - S4C60 




RDEX END 



ABM Mii.'iL' 

Accolade Comia Accnfude 

Agent i'.S.Ar Schohsn'c 

Airheart Brffde^buTid 

Algeblaster Ikn-idson S. Msocinfas- 

Al^ehra t IiiSt^iii^ent Tutor 

Appic Super PiUtt ? 

Balance of Power Mind'^capi' 

Bandits Sinus Software 

Bank Street Filer Biznicrbund 

Bamm\ Computer SAT ? 

Baniezone Aiansofi 

Brain Bank JJie Ohs.prviitnr\- 

Calendar Crafter Ilga MFCC 

Captain Goodnight 7 
Certificate Library Vcfl. I Y 
Cimmpianahip Baaeball ? 

Cohsaus IV Firehird 

Create with Garfield DIM 

Creature Venture Sufiarjuth Co.. 

Croaa Clues Science Research 

Cri>ss Country Rally Sofismith Co. 

CranawOrd Magic Mindscapc 

Crypt of Media Sir Tech 

David's .Widriishi Magic ? 

DB Master V4.0 S{{^nev\'are 

Deatklord Ek'ctromc Arts 

Deep Space Sir Tech 

Dig Thig Datasofi 

Fay: The Masked Woman Didafevh Sofiivare 

Fay's Word Rally Did^ntch Scftn-are 

Fay: Word Hartter Didafevk Sofsvare 

fan Bunch L'nicarn 

Gidaxiun AinrLiafi 

Oemstone Healer SSi 

GoldFinger Mittdscape 

GradeBasters 1-2-3 Gradebusiers 

Gutenbarfu Jr. (t Sr. Microniation LTD 

Handicapping System Spurts Judge 

J ^ S Grade Bnoii J &. S Sopware 

Jigsaw Mirrojiin 

J on at Aiari.'!!oji 

iMzar Maze dmnf-nat-de 

Legacy of the Ancients Electronic Arfs 

Mathbloster Davidson & Associates 

Maxi Golf Thunder Mountain 

Micro league Baseball Microdeague Sports 

Mind Mirror Ekaronic. Arts 

Mr. Do Daitisaft 

Mr. Pixel's Cartoon Kit Mindscape 

Ms. Pac-Man Aturisoji 

Never Ending Story Datasofs 

Odin Odesta 

Peeping Tom Microlah 

Pensale Pt^ngnin 

Personal Finance Manager (PFM) Apple Computer 

I'FS File & Report tigs Sojiw^nr Puhhshing Corp. 

Prime Plotter Primes^p Corp. 

Print Master Unision World 

Pro-Footbali Sports Ji^d^c 

Quiz Castle Didutech Sffftware 

Railroad Wortcs CBS 

Rescue On Fractaiis Epyx 

..Ruski Duck Sop^.-<!tnith Co. 

Scrabble Klectriynlc Arf.^ 

Snaggle Bri^derbund 

Space Eggn Sirus 

Space Journey Mindscnpe 

Stellar 7 Penguin Sofiwure 

Success with Typing VL2 Schofusdc Sufti^xire 

Super factory Sunburst 

Think Tank Living Video 

Tower of Myragten II {Ilgsj 'l 

Toy Shop Broderbund 

Type Brcdi^rbitnd 

Visibknd Mitrolab 

Where in VSA is Carmen San Diego Broderbund 

Wings of Eury Broiierbund 

Work Force II Core Concepts 

Thi Works First Sfor Sofiii'are 

Zorro Diiiasoff 
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COMPCTIST back issues 



To order, Use the back issue order form on page 42 



March 1988 * MSoflkeys: -3400 A.D. -Age Of 
Adventure 'Apple's Core II 'Arcade Boot Camp •Arctic Fox 'Aztec 
•Ballblazer 'Bard's Tale llgs 'Blue Powder Gray Smoke 'California Games 
•Championship Wrestling 'Colonial Conquest 'Comprehension Skills 1.11 
•Conquering Whole Numbers 'Coordinate Math 'Countdown To Shutdown 
'Dataquest: The World Community 'Destroyer 'Dream House 'Dream 
Zone 'Earth Orbit Station 'Equation Math 'Forecast: Your At-Home 
Weather Station 'Fraction Concepts Inc 'Fraction Munchers 'Fraction 
Practice UnlimitetJ 'GBA Championship Basketball 'Genesis 'GEL Football 
'Ghost Rider "Goonics 'Grade Manager v2.3 'Great American Cross- 
country Road Race 'Hardball llgs 'Ikari Warrior 'Jenny's Journeys 'Kid 
Niki Radical Ninja 'Kung-Fu Master 'Learning To Tell Time 'Leisure Suit 
Larry 'Let's Learn About Money 'Let's Learn About The Library 'Letters 
For You "Lords Of Conquest 'Magic Spells 'Math Blaster 'Money Works 
'Maps 6 Globes: Latitude S Longitude 'Marble Madness 'Microzine 
1 8. 1 £1,20 J 1, 23 J 3 'Mist 'Morning Star Math 'Movie Monster Game 
•Multiplication Puzzles 'Multiscribe v3.0c 'Murder On The Mississippi 
•Music Made Easy •Mystery Sentences 'Number Munchers 'Numbers 
Count 'Odell Lake 'Operation Frog 'Opposites Attract 'Oregon Trail v 1 .4 
'Phonics Prime Time: Blends S Digraphs 'Phonics Prime Time: Vowels I, 
II 'Puzzles g Posters 'Quotient Quest 'Reader Rabbit 'Reading Style 
Inventory 'Realm Of Impossibility 'Sesame Street 'Crayon' series 'Shanghai 
'Sons Of Liberty 'Space Quest v2.3 'Story Book: Pixelworks 'Story Tree 
'Subtraction Puzzles 'Super Huey 'Super Wordfind 'Tass Times In 
Tonetown 'Those Amazing Reading Machines HI, IV 'Timothy Leary's Mind 
Mirror 'To Preserve, Protect and Defend 'Tower Of Myraglen 'Troll's 
'MicroCoarseware' series 'Webster: The Word Game 'Word Munchers 
•Words At Work: Compound It 'Words At Work: Suffix Sense •World 
Games 'World's Greatest Baseball Game 'World Karate Championship 
'Writer Rabbit 'Zoyon Patrol * WAPTs: 'Buck Rogers -Ikari Warrior 
•Kung-Fu Master 'Leisure Suit Larry llgs 'Marble Madness •Realm Of 
Darkness 'Rings Of Zilfin 'Space Quest llgs 'Super Boulder Dash 
« MPIaymg Tips: '3400 A.D. 'Donkey Kong 'Infiltrator 'Space Quest 
llgs 'Spy Hunter 'Swashbuckler -Thexder 'Ultima II • * MFeatures: 
'Modify Super lOB to read/write every other track 'APT for Rings Of Zilfin: 
Turn yourself into a lean, mean fighting Machine 'More Softkeys for 
M.E.C.C. software ( 1987) 'How To Use The Electronic Art's RWTS 'APT 
for Realms Of Darkness: Realm's Wrecker! 'Putting Super Boulder Dasli 
onto a hard disk IBMM Softkeys: 'EasyWriter 1.0, II -Zork III 



February 1988 «t mFi^amres: 'The Product Monitor 
•Unprotectirg The Un protect able: Macintosh Softkcysl 'A.P.T. Cornucopia 
•APTiAlternate Reality -[JungeonL Create A Super-human 'ioftkey for SSI's RDOS 
disks: i.ProDOS RDOS. 2 RDOS Transfer Utility "Making Cracked II Plus Disks 
Work On The Ik <t ■5q^jtf_v.v.- 'Apple Gradebookvl. 6 'Award Maker Plus 'Black 
Cauldron 'Black Magic 'California Games 'Car Builder 'Color Print Shop 'Computer 
Ambush 'Concepts In Science 'Disney's Ccmic Strip Maker 'Elite 'Empire L II 
•European Nations £ Locations •Fooblitsky 'Grid Designer 'H.E.R.O. 'Ikari Warriors 
■Infiltrator II 'Le Francais par Ordinateur 'Little Computer People's House on a 
Disk •Main Street Filer -Master Diagnostics He *MegaFiler *,MegaMero(! 
•iMicrOiinc li 'Might £ Magic * Millionaire 'Mindplay softwan; 'Music ConstnJCtion 
Set 'Nibbler 'Operation Market Garden 'Phantasie • Planetfall 'PrintMaster Plus 
•Print Shop 'Questron 'Regatta 'Ring Quest 'Ringside Seat 'Rings Of Zilfin 
'Shanghai 'Silent Service 'Snooper Troops "Spy's Adventure in N. America 'Super 
Prim 'Tass Times In Tonetown 'Think Quick •Transylvania 'Ultima I re-release 
'Where in the USA is Carmen Sandiego 'World Games • Zork I ( * Macintosh 
softkey] * ^A.I'.T.si Alternate Reality: The Dungeon 'Arctic Fox "Bard's Tale 
II 'Beyond Zoi'k 'Black Magic 'Cavern Creatures 'Drol 'Goonles 'Ikari Warriors 
•Zonv * MPItiying Ttps: 'Beyond Castle Wolfensteln 'Championship Lode Runner 
•Conan 'King's Queen II 'Lode Runner 'Lurking Horror 'Station Fall 'Ultima IV 
•Zork I MmSofikeys: 'Lotus 1 -l-i 'Flight Simulator 'PES Report I BM A.P.T.S: 
'Bard's Talc 



^V 1 January 1988 WFeamrcs: 'The Crypt .arithmetic Helper 'Using 
EDD IV to ,Modify Tracks And Sectors 'Bards Tale APT: Dungeon Mapper Revisited 
•RAMf actor mod for Laser i 3S -Ultima IV APT edit- tables 'The Product Monitor 
•Get Better Sound by using the cassette jacks 'Making A Fast Bool Disk 'Might 
£ Magic APT edit. tables MSofikeys: '3400 AD 'Aliens 'Alphabet Zoo 'Amnesia 
-Bag Of Tricks -Bard's Tale I -Bard's Tale II 'Battle Cruiser 'Beach-head II -Below 
The Root -Black Magic 'Body Awareness 'Bridge 4.0 'Carners At War -Catalyst 
3.0 'Centipede -Championship Boxing -Championship Wrestling 'Chessmaster 3093 
'Combining The Elements 'Commando 'Creative Contraptions 'Einstein Compiler 
•Fat City 'Fight Night -Flight Simulator vIO -Fun with Direction 'GBA 2-Qn-1 
Championship Basketball 'GraphicWriter v I . I RA -Growing LJp Small • Ho use- on - 
ij-disk -Intrigue -Jet -Jungle Hunt 'Kiixiercomp -Knowing Numbers -Kung-fu Master 
-Law Of The West 'Learning Well series 'Letters And Words -Little Computer People 
'Make Vour Own ,Murder Party 'Manic Mansion 'Master Diagnostics 'Movie Maker 
•,Music Construction Set 'Pinball Construction Set 'Pitsiop 'Print Shop Graphics 
Library Holiday •Print Shop llgs •Rendezvous •Shapes And Patterns 'Silent Service 
•Sorcerer 'Spy vs Spy I £ II 'Stargate 'Stellar 7 'Stickybear ARCs 'Stickybear 
Drawing -Stickybear Numbers -Stickybear Printer 'Stickybear Printer Library I g 
II -Stickybear Townbuilder 'Super Boulderdash -Temple Of Apshai Trilogy 
•Tomahawk 'Thexder -Walt Disney's Card And Party Shop 'Walt Disney's Cartoon 
.Maker •Wings Of Fury •Word Maze -World's Greatest Baseball Game -Zork 111 
mA.P.T.a: Bard's Tale -Lode Runner -Might S Magic -Ultima IV 'W. Disney's 
Card And Party Slwp -Wizardry III -Wizardry IV mi'itning Ttps: -/Vutoduel 'King's 
Quest 'Manic Mansion 'Summer Games 'Tass Times In Tonetown 'Thcxder 'Where 
In World Is Carmen Sandiego? 



_ December 1987 MFeamrea: 'Super Boulderdash APTwriter 

•Softkeys to Activision; MECC' and PES Pro[X3S.' software 'Double F-8 ROM space 
w.'o motherboard surgery -Ace- Apple bimodal Switch 'Using Sider hard drives Sli", 
30OK drives, £ 5'i" drives in DOS 3. J MSofikeys: -Aliens 'Alter Ego 'Alternate 
Reality 'Amazing Reading Machines 'Amazon 'American Challenge -Arcade Album 
# I 'Arithmetic Critters 'Award Maker -Baseball Database -Bards Tale II: Destiny 
Knight -BCs Quest for Tires -Bop S Wrestle -Champ. Boxing 'Champ, Wrestling 
'Clock Wori<s 'Commando 'Computer Prep for SAT 'Conflict In Vietnam -Counting 
Critters -Crisis Mountain 'Dataquest 50 States -Deluxe Paint II -Dine Eggs -Disney 
Card £ Party Shop 'Disney Comic Strip Maker 'Draw Plus 'Eidolon -Electric Crayon 
ABCs -Expedition Amazon 'Facemaker 'First Letter Fun 'Fish Scales 'fun From 
A— Z 'Game Maker 'GBA Champ. Basketball -GEL Champ. Football 'Graphicwriter 

I .CR,' I . I R -Great Road Race 'Hacker II -Hardball 'Infiltrator II 'Instant Music -James 
Bond 007: A View To A Kill 'Jenny's Journeys 'Rung Fu .Master -Little People 
-List Handler -Manic .Mansion -Mastery Arithmetic Games 'Market Place 'Master 
of Lamp 'Math Rabbit 'Microzine S 1 7 -Might and Magic 'Mission In Solar System 
-Moebius 'Music Construction Set 'Music Studio -Number Munchers 'Paint With 
Words -Paintwori<s Plus 'Path Tactics 'pfsiFilc •pfs:Gr3ph 'pfs:Plan -pfs:Report 
'pfs:Wrlte -Phonics Prime Time 'Portal -Principal's Assistant 'Print Shop ProDOS 
8 vl.4 'Print Shop Holiday Edition -Quickflash! 'Reader Rabbit 'Realm of 
Impossibility 'Robot Odyssey I v. 3.0 'Rocky Horror Show 'Rooky's Boots v4.0 
•Saracen -Shanghai 'Silent Service 'Skylab -Sound Tracks -Speedy Math -Spindizzy 
'Street Sports Elaseball 'Sub-Mission -Super Boulderdash 'Tass Times in Tonetown 
'Thexder -Top Fuel Eliminator 'Word Handler 'Word Munchers -Words at Work 
-World Karate Champ. 'Writer's Choice: Hite -Zardax v5.2,l 



November 1987 MFetnures: 'Eliminate some ProDOS erroneous 
error messages 'Date.'time without a clock card 'Sector surgery: recover lost files 
-Generating Applesoft programs 'on-the-fly' 'Product Monitor reviews mPLUS: 
How to convert List Handler files Into standard text files 'How to make 
GRAPHIC.GRABBERvS run on the llgs -Laser I 38 'absolute' RESET MPhying Ttps 
for: Bard's Tale II. Conan, Donkey Kong. Hacker I, Hard Hat .Mack, Orbitron. Print 
Shop Companion. Spellbreaker. Spy Hunter. Ultima 4 mA-P.Tsfor: Infiltrator. 
Lode Runner, Montezuma's Revenge, Swordthrust series MRDF.X Sojfkeys: 'Addition 
Logician 'Animate -Arcade Boot Camp 'Arctic Fox 'Bard's Tale II 'Cat'n Mouse 
•Counting Critters 'Dam Busters t 'Destroyer 'Draw Plus v 1 .0 -Dr. Ruth's Comp. 
Game Of Good Sex 'Echo I.O'E.D.D. 4 'Gamemaker 'Hard Ball -Infiltrator -List 
Handler T 'Locksmith S.OFastcopy t 'Magic Slate 'Math Critters 'Millionaire -Mind 
Mirror -One On One -Paintworks Plus v 1 .0 'Paintworks Plus v I . I -PHM Pegasus 
'Portal -Quotient Quest -Reader Rabbit 'Saunder's Chemistry CAl 'Science Toolkit 
-Shanghai 'Strip Poker t 'Super Bunny 'Super Sunday 'Swordthrust series t -Term 
Paper Wnter 'Thief 'Top Fuel Eliminator -Typing! t 'Up-n-Down 'Willy Byte 
'Writer's Choice ■ Elite v 1 .0 -Writing A Character Sketch -Writing A Narative 
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MORE back issues 



To order, Use the batk-issue order form on page 42 



October 1987 UFeaiurcs: "Dungeon Editor 6 Encounter 
Editor for Ultima III •APT for Shadowkeep 'Softkey tor Shadowkeep 
•Softkey for Apple Business Graphics URDEX Softkeys; "8 1 6 Paint GS 
•Amnesia "Arctic Fox 'Award Maker Plus 'Bard's Tale II •Betterworking 
Word Processor •Beyond Castle WoKenstein 'Black Magic •Bookends 
Extended "Bop S Wrestle •Chess 7.0 'Chessmaster 2000 •Deluxe Paint 
GS "Destroyer •Hacker II 'Hacker II GS 'Hardhall 'Infiltrator 'Instant 
Music GS •J-BIrd •Mabel's Mansion •Marble Madness •Mean I S GS Golf 
•Megabots 'Might S Magic 'Miner 2049er II •Mouse Word 'Music 
Construction Set GS 'Music Studio GS 'New Oregon Trail 'Paintworks 
Plus I ,OGS 'Paintworks Plus 1 ,0GS 'Paul Whitehead Teaches Chess 'PHM 
Pegasus 'Poetry Express 'Print Shop color version •Rambo: First Blood 
part II 'Rocky Horror Show "Sargon III* •Shanghai GS •Spindiz^y 
•TeiePorter 'Temple Of Apshai trilogy 'Top Draw GS "Transylvania 
"Ultima I • World's Greatest Baseball Game 



September 1987 WFeaiures: 'Infocom-text Reader 
Enhancement 'Color Ultimapper mod to Ultimapper IV 'Towne Mapper 
utility for Ultima IV "Dungeon Mapper uiility for Bard's Tale "Hardware 
Corner: Interrupting Your Apple "Sofll<ey for Charlie Brown's U,3s 
MRDEX Sofikeys: "Guitar Wizard •Gemsione Warrior •Notable Phantom 
•Micro Wine Companion "Stickybear Printer "Note Card Maker •Starcross 
•Wishbringcr "Dinosaur Dig •Dam Busters •Pirate Adventure "Infiltrator 
"MECC software "Banner Catch •Turtle Tracks •PES File "Microzine # I 3. 
# I 3, # 1 4 "Marble Madness 'Writer Rabbit 'Arcticfox 'Age Of Adventure 
'Might And Magic 'Space Station 'Alternate Reality 'Mindshadow 
'Gemstone Warrior 'Strip Poker 'Lucifer's Realm "Manuscript Manager 
'Bank Street Writer III 'Kids On Keys 'The Missing Ring "Graphic Solution 
"Empire k II 'Champ. Golf 



August 1987 MSofskeys "Advanced Microsystems 
Technology programs •Word Attack •Star Blazer 'Science Toolkit "The 
Color Enhanced Print Shop "Video Vegas "The Handlers 'K.C. Deals On 
Wheels "Law Of The West 'Break The Bank Blackjack "Foundahon Course 
In Spanish "OGRE 'Puzzles And Posters MFetiiures 'The Shift Key/Lower 
Case Option For 11+ 'Amazing Computer Facts 'Shape Magic utility 
MRevii^w-. Multi scribe 



July 1987 MSofikeys 'Mouse Calc 'Sands oT Egypt 
'Number Farm 'Agent U.S.A. "Wavy Navy "Kindercomp 'Flight Simulator 
Update 'Raid over Moscow "Crime Stopper "Key Perfect 5. 'The Final 
Conflict 'Miss Mouse 'Snoggle WFeamres "Write Protecting the Microsoft 
RAM Card "Keys to Success on the Franklin Ace "Modified F8 ROMs on 
the Apple /.;'/ WCore 'Owner's Review of Copy Master II 



June 1987 WSofikeys •Arcade Boot Camp "Goonies "Zorro 
•Coveted Mirror "Crimson Crown "Compubridge "Fleet System 3 
"Microwave "Escape "Catalyst 3.0 "Number Farm "Alphabet Circus "Joe 
Theisman's Pro Football 'Black Cauldron "Intern. Gran Prix MFeatures 
"Making DOSIess Utilities "Pixit Printer Drivers WReview: Z-RAM Memory 
Expansion Board "Reading the Joystick 



May 1987 MSofikeys 'Graphics Expander 'Information 
Master 'Certificate Mai<er 'Elite "Catalyst 2.0 and 3.0 'Murder On The 
Mississippi "Temple Of Apshai Trilogy "Troll Associates programs 'Spell 
It •Regatta 'Cdex Training programs 'Think Fast MFeatures 'How to 
Write-Protect your Slot Zero 'Capturing Locksmith 5.0 Fast Copy 
'Revisiting DOS to Pro DOS and Back MCore "Computer Eyes ,' 3: a Review 
MAPTs 'Sword of Kadash g Rescue Raiders 'Ultimaker IV 



April 1987 MSoftkeys 'Light Simulator 'Beach-Head 
•Monty Plays Scrabble 'Racter 'Winnie the Pooh "Infocom Stuff, Kabul 
Spy, Prisoner II "Wizardry I S 2 "Lucifer's Realm •ThePFS Series 'Dollars 
and Sense •Strip Poker 'Coveted Mirror 'Wizard's Crown 'The Swordthrust 
Series •Axis Assassin 'Manuscript Manager "The Crown of Arthain "Address 
Book "Decimals 3,0 •Dragonfire MFeatures 'Auto Duel Editor 'Wizard's 
Crown Editor •Questron Mapper MCore •The Games of 1 386 in Review 
MAdvemure Tips "Ultima IV 

^fc 1 March 1987 MSofikeys "The Periodic Table 'Gemstone 
Warrior "Inferno "Frogger "Story Maker •Adventure Writer "Mummy's 
Curse "Zaxxon 'The Quest "Pitfall II "H.E.R.O. MFcaiurcs "A Two-Drive 
Patch for Winter Games 'Customizing the Speed of a Duodisk "Roll the 
Presses Part Two: Printshop Printer Drivers 'The Games of 1986 

^■^# February 1987 MSoftkeys "Adventure Writer 'E-Z Learner 
"Mychess II "Raster Blaster 'Cranston Manor 'Ghostbusters 'Designer's 
Pencil "The American Challenge "Encyclopedia Briiannica Programs "Crime 
Wave MFeatures 'Taking the Wiz out of Wizardry 'Adding a Printer 
Card Driver to Newsroom MCore Games of f985 



,»,,»- January 1987 MSoftkeyx 'M\D\!S+ "Homeword v2. 1 
'Borrowed Time 'Amazon "Speed Reader ][ "Discovery] 'M-ss-ng L nks 
series "Donald Ducks's Playground "Mastering the SAT "Copy )[ Plus 4.4C 
•Master of the Lamps "One on One •Bridge Baron "A.E. "Great American 
Cross-Country Road Race "Computer Preparation for the SAT "Castle 
Wolfenstein "Luscher Profile 'Skyfox 'Silent Service 'Echo Plus 
•Swashbuckler 'Randamn MFeatures 'Electronic Disk Drive Swapper 
•Abusing the Epilogues "Print Shop Companion's Driver Game MCore 
•Keyboard Repair 'Fixing the Applesoft Sample Disk 



December 1986 MSoftkevs 'Cycled 'Alternate Realty 
'Boulder DashU II "Hard Hat Mack (Revisited) "The Other Side "F-IS 
Strike Eagle •Championship Lode Runner •Gato V 1.3 'I, Damiano 
•Wilderness 'Golf's Best MFeaiures 'The Enhanced,' Unenhanced lie 
"Looking into Flight Simulator's DOS MCore 'Appavarex 'Installing a 
RAM disk into DOS 3.3 



November 1986 MSofikeys 'Under Fire 'Pegasus ][ 'Take 
I (revisited) 'Flight Simulator II v 1 .05 (part 2) "Magic Slate "Alter Ego 
"Rendezvous 'Quicken "Story Tree "Assembly Language Tutor "Avalon 
Hill games 'Dark Crystal MFeatures 'Playing Karateka on a ,'.'c "Track 
Finder 'Sylk to Dif MCore "Breaking In: tips for beginners "Copy ][ Plus 
6.0: a review "The DOS Alterer 



October 1986 MSofikeys "Flight Simulator II v 1.05 
"AutoDuel "Critical Reading 'Troll's Tale "Robot War 'General Manager 
"Plasmania 'Telarium Software "Kidwriter v 1 .0 'Color Me MFeatures 
• Screenwriter meets Flashcard "The Bus Monitor 'Mousepaint for non- 
Apples MCore 'The Bard's Dressing Room ■/tP7 'Championship Lode 
Runner 



September 1986 MSofikeys "Olympic Decathlon 'Hires 
Cribbage 'Revisiting F- 1 5 Strike Eagle "Masquerade 'The Hobbit "Pooyan 
'The Perfect Score "Alice in Wonderland 'The Money Manager "Good 
Thinking 'Rescue Raiders MFeature: Putting a New F8 on Your Language 
Card MCore: "Exploring ProIX>S by instaling a CPS Clock Driver 
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To order. Use the back order form on page 42 



August 1986 MSoftkeyx •Crisis Mountain "Terripin Logo 
•Apple Logo 1! 'Fishies 1 .0 "SpeilWorks •Gumball •Rescue at Rigel •Crazey 
Maiey "Conan 'Perry Mason: The Case of the Mandarin Murder "Koronis 
Rift UFeamre: 'Mor? ROM Running MCore: •Infoconi Revealed 



July 1986 USoftkeys 'Word Juggler •Tinkl Tonkl 'Sundog 
v2.0 •G.I, Joe g Lucas Film's Eidolon •Summer Games II •Thief •Instant 
Pascal "World's Greatest Football Game "Graphic Adventure ft I •Sensible 
Grammar 6 Extended Bookends •Cliipwits 'Hardball -King's Quest II -The 
World's Greatest Baseball Game Ufeature: "How to be the Sound Master 
MCore: "The Mapping of Ultima IV 



June 1986 

Baudviile Software 



•Cubit 



tSqftkeya •Revisiting Music Construction Set 
•UitJit •tiauavuie ^0Itware •Hartley Software "Bridge "Early Games for 
Young Children "Tawala's Last Redoubt 'Print Shop Companion "Kracking 
Vol II "Moebius •Mouse Budget, Mouse Word g Mouse Desk 'Adventure 
Construction Set MFeamr-e: "Using Data Disks With Microzines UCorc: 
•Super lOB vl.S a Reprint 

3 X May 1986 USofikeys "Trivia Fever "The Original Boston 
Computer Diet "Ufesaver "Synergistic Software "Blazing Paddles 'Zardax 
•Time Zone •Tycoon 'Earthly Delights 'Jingle Disk •Crystal Caverns 
•Karate Champ mFeamrc: 'A Litde Help With The Bard's Tale mCore: 
'Blacl< Box 'Unrestricted Ampersand 



_ _ April 1986 Sofikeys " Millionaire " SSI's RDOS ' 
Fantavision ' Spy vs. Spy • Drago'nworld • King's Quest • Mastering the 
SAT ' Easy as ABC • Space Shuttle • The Factory ' Visidex LIE' Sherlock 
Holmes • The Bards Tale • Feature • Increasing Your Disk Capacity • 
Core • Uftimaker IV. an Ultima IV Character Editor 



Mar(;h 1986 Sofikeys • Threshold • Checkers v2.l " 
Microtype • Gen. g Organic Chemistry Series " Uptown Trivia • Murder 
by the Dozen • Windham's Classics • Batter Up ' Evelyn Wood's Dynamic 
Reader • Jenny of the Prairie • Learn About Sounds in Reading • Winter 
Games • Feature • Customizing tlie Monitor by Adding 65C01 Disassembly 
• Core ' The Animator 



Kebruary 1986 Softkeys ' Ultima IV ' Robot Odyssey • 
Rendezvous • Word' Attack S Classmate ' Three from Mindscape • 
Alphabetic Keyboarding ' Hacker ' Disk Director ' Lode Runner ' MIDI,'4 
" Algebra Series • Time is Money • Pitstop II ' Apventure to Atlantis ' 
Feature ' Capturing the Hidden Archon Editor • Core • Fingerprint Plus: 
A Review • Beneath Beyond Castle Wolfenstein (part 2) 



_ January 1986 Sofikey-^ * Microzines I -5 • Microzines 
7 -9 I Microzines (alternate method) • Phi Beta Filer • Sword of Kadash 
" Another Miner 3049er " Learning With Fuzzywomp " Bookends • Apple 
Logo II • Murder on the Zindemeuf • Features • Daleks: Exploring Artificial 
Intelligence " Making 32K or I 6K Slave Disks • Core " The Games of 
(985: part II 



Sofikewi • DB Master 4.3 " Business Writer " Barron's 
Computer SAt " take 1 " Bank Street Speller • Where In The World Is 
Carmen Sandiego • Bank Street Writer I28K ' Word Challenge ' Spy's 
Demise ' Mind Prober ' BC's Quest For Tires ' Early Games • Homeword 
Speller ' Feature • Adding IF THEN ELSE To Applesoft • Core " DOS 
To ProDOS And Back 



Softkeys " Cannonball Blitz • Instant Recall " Gessler Spanish 
Software • More Stickybears " Financial Cookbook " Super Zaxxon • 
Wizardry " Preschool Fun • Holy Grail " Inca ' 13 8K Zaxxon ' Feature 
' ProEdit • Core • Games of 1985 part 1 



Sofikeys ' Electronic Arts software • Grolier software • Xyphus 
• F- 1 5 Strike Eagle ' Injured Engine • Mr, Robot And His Robot Factory 
' Applecillin II • Alphabet Zoo • Fathoms 40 ' Story Maker ' Eariy Games 
Matchmaker • Robots Of Dawn • Feature • Essential Data Duplicator 
copy parms ' Core 'DOS-Direct Sector Access 



Softkeys ' Choplifter • Mufplot • Flashcalc ' Karateka • 
Newsroom • E-Z Draw • Gato ' Dino Eggs ' Pinball Construction Set ' 
TAC • The Print Shop: Graphics Ubrary ' Death In The Caribbean • 
Features • Using A,R,D, To Softkey Mars Cars ' How To Be The 
Writemaster • Core ' Wheel Of Money 



Sofikeys • Miner 304 9er ' Lode Runner • A3-PBI Pinball 
• The Heist • Old' Ironsides ' Grandma's House • In Search of the Most 
Amazing Thing ' Morloc's Tower ' Marauder ' Sargon III • Features • 
Customized Drive Speed Control ' Super lOB version 1 .5 ' Core • The 
Macro System 



Softkeys ' Sargon III • Wizardry: Proving Grounds' of the Mad 
Overiord and Knight of Diamonds • The Report Card V I , ( • Kidwriter 
' Feature ' Apple j[ Boot ROM Disassembly • Core • The Graphic urabber 
vS.O • Copy 11+ 5,0; A Review • The Know Drive; A Hardware Evaluation 
• An Improved BASIC'Binary Combo 



_ Softkeys ' Rendezvous With Rama ' Peaehtree's Back To Basics 

Accounting System ' HSD Statistics Series ' Arithmetickle • Arithmekicks 
and Eariy Games for Children ' Features ' Double Your ROM Space ' 
Towards a Better F8 ROM ' The Nibbler; A Utility Program to Examine 
Raw Nibbles From Disk • Core • The Games of 1 984; In Review-part II 

1 6 Sofikeys • Sensible Speller for ProDOS ' Sideways ' Rescue 
Raiders • Sheila • Baste Building Blocks • Artsci Programs ' Crossfire • 
Feature • Secret Weapon: RAMcard ' Core • The Controller Writer ' 
A Fix For The Beyond Castle Wolfenstein Softkey ' The Lone Catalog 
Arranger Part I 

1 Sofikeys ' Data Reporter ' Multiplan ' Zork ' Features • PARMS 
for Copy il Plus • No More Bugs • APT's for Choplifter g Cannonball Blitz 
• 'Copycard' Reviews ' Replay ' Crackshot ' Snapshot ' Wildcard 



If you are also interested 
in obtaining out-of-print back-issues 

Please see the descriptions 
listed on page 41 
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and Ottt-of -print back issues 

Due to popular demand - 

these sold-out issues are available now as 'zeroxed' copies, 

full-sized and center stapled. 



^S 1 USoftkevs: *DB Master version 4 + "Pazzle Draw •Archoii 
•Twerps MR{:'aik>rs ' Soffkeys: •Advanced Blackjack 'Megaworks •Summer 
Games •College Entrance Exam Prep "Applewriter revisited UFeumi-i',^ : 
• Demystifying The Quarter Track MCore: •Prpsliadovv: A Pro DOS Disk 

Monitor 

1 ^S MSoftkevi: 'Scholastic Version of Bank Street Writer 
•Applewnter //e •SSI's Non-RDOS Disks mRemlefs' S(>fike\s: -BPI 
Accounting Programs and Design Ware Programs Ufcatiires: "Installing 
a Free Sector Patch Into Applewriter .'.e "Simple Copy Protection UO»-e: 
•The Games of 1984: In Review *6SC01 Chips Now Available •Checksoft 
v2 



1 M USoftkeys: "The Print Shop "Crossword Magic "The Standing 
Stones "Beer Run "Sky fox "and Random House Disks MFcature^. "A 
Tutorial For Disk Inspection and the Use Of Super lOB "S-C Macro Assembler 
Directives | reprint) MCon-: "The Graphic Grabber For The Print Shop "The 
Lone Catalog Arranger Part Two 

1 ^^ USofikevs: •Mastertype •Stickybear BOP •Tic Tac Show 
MReader''; Sqfi'keys: "The Financial Cooi^book •Escape from Rungistan 
"Alien Munchies •Millionaire •Plato Ufeaniiv.'i: •MREAD.'MWRT Update 
■ CVirc *\ Boot from Drive 2 "DB Master s Data Compression Techniques 
MWiiz Kid: "DOS and the Drive ■ Part One UAilveiilurc Tips: -Time 
Zone "Mission Asteroid "Enchanter •Zork I "Ultima • Ultima II "Death 
in the Caribbean "Gruds in Space "Zork III 'Starcross 



MFeatun's: 'Super lOB v 1 .1 Update "Putting Locksmith 5.0 
fast Copy Into a Normal Binary File •Batman Decoder Ring "A fix for 
DiskEdit USujikeys: "Seadragon "Rocky's Boots •Knoware •PES Software 
•Computer Preparation SAT "MatheMagic URcvic»': "Boulder Dash 



i O USoftkt'\x: 'Arcade Machine "Bank Street Writer "Minit Man 
MRcMler's Softkcys •Seniblc Speller tV 'EDD IV • ' Kreil LOGO "Canyon 
Climber UFcunircs: •The Controller Saver •Examining Protected Applesoft 
BASIC Programs •Crunchlist II MCore: "Applear ■ Voice Aynthesis 

• Introducing the 65SCS03 and 65SC8I6 Chips •Review ■ Dino Eggs 
UAdvt'imtrc Tips: •Cranston Manor •Zork I •Planctfall 'Mission Asteroid 

• Time Zone 'Suspended •Critical Mass 'Zork II 'Castle Wolfenstein 

^F ■ Sf j/Jit f v.v ■ • S e ns ibte Spe I ler ' S ier ra -0 n ■ Li n e S ft wa re • T he V i s i bl e 
Computer: 650^2 UReudfr'.'i Snfikcv.': : 'Visidex "Music Construction Set 
•Gold Rush •Visiterm •Cosmic Combat ■ Features; •Super lOB 
MAdveiitiirt' Tipt: •Pirate Adventure •Mask ot the Sun •Colossal Caves 

• Transylvania •Death in the Caribbean •Zork II BCore: •Word Search 
Generator •ProDOS to DOS •ProDOS on a Franklin Ace 

^S MSuftkcys: 'Robotron "Legacy of Llylgamyn 'The Artist 'Data 
Factory v5.0 ' EDD IV MReader's Sofrkeys: 'Spy Strikes Back 'Hayden 
Software •Apple LOGO MFct-iUin's: •Review of the Bit Copiers MCore: 
'COREfiler 'ProDOS Data Encryptor MAdveniure Tips: 'Ulysses and The 
Golden Fleece "Serpentine 'Ultima II 'Castle Wolfenstein 'Death in the 
Caribbean •Zork I 'Zork It 'Gruds in Space 'Enchanter •Infidel 'Serpent s 
Star MMii: Kid: "How Data is Stored on Disk 



r« MSofikeyi: "Zaxxon 'Mask of the Sun 'Crush 'Crumble & Chomp 
•Snake Byte 'DB Master "Mouskattack MFctiitires: "Making Liberated 
Backups That Retain Their Copy Protection •S-C Assembler: Review "Disk 
Directory Designer UCorc: •COREfiler: Part I •Upper S Lower Case 
Output for Zork 

^> MSoftkews: •Pandora's Box •Donkey Kong "Caverns of Freitag 
•Visifile MFeaiures: "Program Enhancements; Quick. Bug 'Personalizing 
A Program 'Modified ROMs MReview 'Essential Data Duplicator "The 
CIA MCore: "Data Bases 



MSof!ke\<i: 'Laf Pak "Beyond Castle Wolfenstein "Transylvania 
•The Quest •Electronic Arts •Snooper Troops (Case 2) •DLM Software 
•Learning With Leeper •TellStar MCore: 'CSaver: The Advanced Way 
to Store Super lOB Controllers •.Adding New Commands to DOS 3.S •Fixing 
ProDOS 1 .0. i BSAVE Bug MReview: •Enhancing Vour Apple MFmiure: 
• Locksmith 5.0 and Locksmith Programming Language. 

X 2 MSopkeys: •Zoom Graptitx •Flip Out 'Lion s Share 'Music 
Construction Set MRcader'}: Softkey^s: 'Hi-Res Computer Golf II 'SLiicide 
•Sabatage •Millionaire 'Time is Money 'Type Attack ■frti/wrt'.v. Pseudo- 
ROMs on the Franklin Ace ICorf 'Psychedelic Symphony 'The CORE 
Disk Searcher 'The Armonitor MAdvenliire Tips: 'Cranston Manor ' 
Enchanter 'Kabul Spy 'Colossal Caves •The Witness "Pirate Adventure 
•Ultima lll-Exodu?, •Adventureland 



1 1 MSoflkeys: 'Sensible Speller "Exodus; Ultima III MReuders' 
Sofik(^\s: 'SoftPorn Adventure •The Einstein Compiler v5.3 'Mask of The 
Sun MFeamnv: 'Copy II Plus v4.4C: Update Of An Old Friend 'Parameter 
List For Essential Data Duplicator MCore. 'Ultimaker III 'The Mapping 
of Ultima III 'Ultima II The Rest Of The Picture 



^^ MSoftkvys: 'Flomeword 'Aztec 'tBag of Tricks 'Egbert II 
•Starcross 'Hard Hat Mack 'The Home Accountant MReadcr's Softkevs: 
•Dark Crystal 'Screenwriter II 'Visifile 'Lancaster 'Bill Budge's Trioigy 
of Games 'Sammy Light foot 'Amper-Magic 'Buzzard Bait MFreamre: 
'Getting on the Right Track 



^fc MFeamres: Ultima II Character Editor I 
•Witness 'Prisoner II "Pest Patrol MAdveniim' Tips. 
II Plus Parms Update 



tSofikew's: 'Ultima II 
'Ultima IIS III BCopy 



«S MSoftkevs: 'Bag of Tricks 'Multiplan MReaders' Softkeys: 
•Visiplot .'Visitrend •Sneakers 'Wizardry UFeafunw 'No More Bugs: The 
Sequel 'Hidden Locations Revealed 'Map Maker MA.P.T.s "Choplifter 
MAd veil I lire Tip.s 'Cranston Manor •Strange Odyssey 

^S MSqfikey.s: •Magic Window II 'Multiplan UFearures: 'Parameters 
for Locksmith 4. 1 'Page Flipper 'String Plotter "Three D Wail Draw 
MCoir: Checksums Mlnpur: •Reviews of unprotected commercial software 

To order, Use the back issue order form on page 42 
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Best of Hardcore Computing.. • CJ • 

Only the disk is available 

Core Special Combo $10 CJ • • 

[All three CORE magazines^ no disks) 

Sonie disks appty 10 mDre tl^an on& iggus and are sfBwn as taller Soxes. 
Special "Both" ti\^ & magazitye corniitiatien oriters apply to one issue 
artd its corresponding disk. 

* Limited supply; firsl-eome-first.s&rvg basis. 

* t^ot availabie- 

O Out-of-print; only 'Zeroxed' oopies for sale. 



comruTisT I 

I 

back issues and library disks are I 
frequently referenced in current issues, j 



Back Issues and Library Disk Rates 



• us, Canada and Mexico back issue rate - $4.75 each. 

• All other Foreign back issue rate - $8.75 each. 

• US, Canada, Mexico library disk rate - $9.95 each. 

• All other Foreign library disk rate - $11.94 each. 

• "Both" disk and inagai:ine rates for: 

US, Canada & Mexico - $12.95 each combination. 
.AH other Foreign - $1§.95 each combination. 

Wkcii id a Qihnwu^ dUh7 

A library disk is a disiiene ihat contains programs that would normally have to be typed in by 
the user. Documentation for each library disk can be found in ihe corresponding issue; 

• Library disks arc available for all issues of COMPUTIST ^ 1 thru 54. If you wish to purchase 
a library disk not listed on the left (under the DISK coluttin), used she out-of-print back issues 
ad on page 42. 
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^^^'i^E 3 Games: constructing Your own joystick* Campillng Games* G^t.WffiEkVtlK.- 
Over 30 of the latest and best* PicK Of The Pack: AIHimeTOP 20 games* Destructive Forces* EAMON* Grapftcs f^agician 
and GraFORTH" Dragon Dungeon 



} 



CORE 2 

Find* Ouick Copy: Copy* . 



UtillteS: Dynamic IWenij* High R^s; Elproll pemo'.QOTQ Latpel: Replace* Line 



;--!■ «'#!,5Kg**a *?&!«:*.! 



1 OraphlCS : Memory Map* Text Grapfiics: Marquee* Boxes* Jagged Scroller* Low 
Res: Color Character Cfiart* Higti Res: Screen Cruncher' The UFO Factory* Color* Veclor Grapfiics: Shimmering Shapes* 
A Shape Table l^iri-Editor* Block Graphics: Arcade Quality Grapfiics for BASIC Programmers* Animation 



Hardcore Computing 3 

Review of Bit Copiers* Boot Code Tracing* Si 



HyperDOS Creator* Menu Hello* Zyphyr Wars* Vector Graphics* 
g* Softkey lOB* Interview with 'Mike' lilarkkula 



Name 



. ID#. 



Address 



City 



State 



Zip — 



Country _ 



Sigriature. 



.Phone. 



Exp 



_CP54 



• US funds dravKti on US bank. • Most orders shipped within 5 working days, hoviiever please allow 
up to 4 weeks delivery for some orders. • Most orders shipped UPS, so please use street address. 

• Offer good while supply lasts. • In Washington state, add 7.8% sales fast. •Send checWmoney 
order to; 

COMPLTIST PO Box 11084fi-T Tacrima, WA 98411 (206), 474-57S« 
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the COMPUTIST shopper 



Software Package 



11 + 



llgs 



816 Paint S45. 

Airhean S24. 

Award Maker Plus S24. 

Bank Sireet Writer 64K $46 

Bank Stieet Speller J46 

Bank Street Mailer 64K, - $46 

Bank Street Filer 64K $46 

Bank Street Writer Plus (12aK) $46 

Bank Street Mafler 128E $46 

Bank Street Filer 128K $46 

Beagle Graphics $35 

Beyond Zork ■,:-.,..■, $27 

Black Cauldron 127 

Captain Goodnight $24 

Championship Karate $14 

Ckp Art Ganery (for Paintworks Plus) S2tl. 



Copy II Plus vB.O : 

Dazale Draw 

Defender of the Crown. 

Destroyer 

DiskQuirk . . . , 

Draw Plus. .■ . 

F-15 Stnke Eagle . 

Fantavision 

Flight Simulator II 

Gamemaker 

GPLE 

The Graphics Studio 

Hacker II 

Hardball 

Hitchhiker's Guide 

Infiltrator 11 

Jet 

Karateka : . : , 



m r mm u 

.tor 

mz 

.in 

MD 

mD 

M-i 
MU 
MD 

mu 

M\2 

.III 

C 

mL 

c 

ml. 

wr 

ML 

mh 

Mf 

M L mm u 

MD. 
ML 
50 C 

mn 

MC $miin 



_r 



S23 



S27. 



mz 

WD 



$23 
. S4SI. 
. $32. 

$25. 
. $18. 
. $52. 

. $24: 

$34. 
. $36. 

$34 

$29. 
.$42 

S25. 

'S22^MD $28.ai}: 

. mM n 

. mM u 

S29.(w n 

$24.M n 

King's Quest 11 $32.il J $32.1 [ 

Knight of Diamonds $23.80 "1 

Lahrinth $28.88-3 

Legacy of Llylgarayii ... $26.88 J 

Loderunner $24.80 H 

Macroworks m»'^ 

Math Blaster ; $28,801 

Math Rabbit $27,801 

Mean 13, Ultimate Golf $28.80 II 

Merlin ProDOS ,.. $65,801 

Might & Magic $32,801 

Millionaire 11... .,...; : $40,801 

Motisewnte ; $99.00 1 $99.80 '. 

Muttiscribe , $45.08 ^ $66.80 '. 

MiBic Studio ■, S62.88r 

Paintworks Plus $52.88 C 

Portal , S3088L 



Softivart PatkagE 1 1 -I- 1 1 gs; 

The Pnnt Shop SSWQ §1^^' 

Print Shop Corapamon. . , S27.Mf.n 

Print Shop Graphics Library^ 

Disk One $16.58 D" 

Disk Two $15.50D- 

Disk Three ,, , $1131 

Pro-Byter ..' ,' '. $32.11 

Racter .,,. S30.801 

Reader Rabbit $27,801 $34.88 C 

Rocky's Boots $34,801 

Science Tool Kit: Master Module, , $46,80 1 



SDI 

Shanghai 

Silent Service ....i 

Solo Flight 

Space Quest 

Star Trek- The Kobayashi Alternative . . 
Star Trek 11- The Promethean Prophecy . 
Stickybear Series: 

ABC's '...<:..:...:^. .:.::... 

Math I 

Math II 

Numbers ., , ..... 

Reading — .,-,.., ... ,.,,,-.-:,. 

Shapes ; 

Typing ..,,..,.,, 

Writer '. t. i -..w, 

Sub Mission 

Summer Games ..,,.,,,. 

Super Macroworks 

Tass Times in Toneto^m , .....•:.■ 

The Tower of Myragten. ■,,..,■.., :,■.:,■. 

Thexder 

Topdraw . ,,,.,.,....,,.,,... ... 

Type $30,801 

Typing Tutor IV _... , $32.80 1 

Video Vegas : ,,■....,,;■..,..., . $18,801 

Visuahjer $53.80 1 

Where in USA is Carmen San Diego $30.00 1 

Where m World is Carmen San Diego $30.80 1 

Winter Games $25.00 1 

Wizardy $32.00 1 

Word Attack $28.M.D 

WordPerfect w,' Spelng Checker- $95.00 D 

World Games $25,000 

Writer's Choice Elite $60.M.D 

Writer Rabbit $24.M:Q 

Zork Trilogy - ,... $4e;Mn" 



$32.11 
S24-.lt: 
. $2im D 
S23.M D 
S32.MC 
S27.M C 
S27.[M D 

&.m.D 

mmc 

. S24.1 D 
tUM-D 

mm.D 

$2AMU 

mM.D 

%UMD 
. S27.(Mr 

.mill 

. $30.1 C 

. S24.1 D 

. S32.1 C 

S23.M C 

$66.[Mi: 



mM D 

S32.MC 



S24.1 D 
S23.0eG 

$32,801 
$59,801 

$27.00 1 



$95.08 L 
$27,00 



COMPUTIST 
is proud to 
offer these 
LOW software 
prices* for 
Apple U and 
iigs software 



* Price.<i ^ubjecL to 
change withoLit notice. 

Because we do not 'stock'and 
order on/y the software needed, 
the COMPUTIST Shopper car^ 
keep it's operating costs to a 
minimutv and can pass the 
savings on to you. 

In most cases, your order is 
shipped within two wee/ts. The 
COMPUTIST Shopper will NOT 
cash your check nor charge 
your credit card until your 
software is ready to be shipped. 
If the software you ordered is 
not available, you will have 
the option to cancel your order, 
or making an alternative 
selection. 



How To Order 



• US orders; Check the box for 
your selection. For Apple llgs 
software, check the box in the 
right-hand colunnn. 

• Please add $3 per order for 
shipping & handling. Orders over 
$200 receive iree shipping. 

• Most orders shipped UPS, so use 
your street addresii. 

• Washington state, please add 
7.8% sales tax. 

t Offer good while supplies last. 

• Foreign Orders; Please inquire 
as to appropriate shipping fees 



Name. 



_ID#_ 



Address 
Ciry 



State 



Zip 



Country 

Signature. 



_ Phone _ 



Exp. 



_CP54 



SoRKey PublisKing PO Box 110816-' 



lacoma WA 98411 



• Software 
SUBTOTAL _ 

• Plus 

SHIPPING _ 
(see above) 

• WA residents 
Sales Tax _ 
7.8% 

■ TOTAL 
Enclosed __ 
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New IBM COMPUTIST? 

In order to make IBM RDEX easier to 
read ant! understand, the following formats 
will be used. 
CommaDdE you typ« aie bold. Long lines 

tend to wrap down like tbis 
But iJon V type ihesc comments 

Remember, press the lEMTER I kry after 
every cornmand line. If something important 
in shown on the monitor after a command, 

i t wi I be shown 1 1 Ke th i s 

DEBUG is usually invoked in soft!<:eys. It has 
several pow'e rft.il single -letter commands listed 
below: 

Assemble addrass 

Compare range/address 

Du nip range /address. 

Enter addrexs list 

Fill range list 

Go address 

Hexarithmetic value value 

Input from port-address 

Load file address drive secwr sector... 

Move tDetnory range address 

Name oi" file drive path filename. exf 

Output control port-address 

Proceed address value 

Quit debug 

Register register-name 

Search range li.<tt 

Trace address value 

Unassemble address/range 

Write address drive sector sector. . . 



Mike Basfotd 



Some of these are from BBS,,. 



Putting Sargon III on harddisk 



Here's how XT-owners can transfer 
Sargon III to hard-disk (assujiic Ssirgon Disk 
is in A:, and default drive is C:) 

C; 

COPY A: SARGON.III SARG0N3.COM Original 

S.ARGOI^-lCOM is ignored 
DEBUG 

N SARG0N3.COM file name 

L bud new S.ARGOKICOM 

A 7F9F A.'isemble the foHowini;: 

MOV AH,l ,a 
[ENTER I 

A S3E1 AsseinMe the folbwing: 

MOV AH,2 



lEHTER 1 

W 

Q 

COPY AiBOOO.BOK 



writt! 
quit DEBUG 



B000.BOK contains the book openings. 
None of the other files are required and should 
not be copied to fixed disk. Sargtm should 
function normally, 

<J) Unfortunately, when S^rgoii exits, 
it reboots the system. Can anyone iind an easy 
change for that one, 

Softkey for,,. 



Time Manager 



IBM 



■ Requirements 

3 DEBUG 

~ Time Manager disk (80-column version) 

L lloppy drive address and a destintition drive 

address (may be a hard disk or floppy) 

Place a disk with DEBUG in drive C: and 
Tinia Miinager disk in floppy drive A: 



DEBUG 

L eOO A5 40 

F DS:100 L 500 '■ 

RCX 

600 

N ii:TM.COM 



lion i ipecify a filentiine yet 

drive ,4 = 0, drive B=l , etc. 

) pad !00-6(I>@with\Ws 

and at ihe primpt (:}, rype: 

Isizfj 

.( aiti he anv drive wii n-ant to 



contain the unprotected iiuxlnle. 
W write the file 

Q and quit DtMIG 

That's it. 'You can now run the new 
TM.COM without the floppy, but you will 
still need the data disk and TM will do 
physical drive selection on the data disk. For 
example, on my Davong system, floppy drive 
2 is logically addressed as D: but to TM it 
is B:. 

Softkey for,,. 



R:base 40© vUl 



I 1 I Format a System Disk under DOS 
2.0 OR 2,1 and label it according to the 
original R:BASF diskette, 

I 2 I Copy the files from the original 
diskette to the corresponding DOS 2,x 
formatted diskette and put the original 
R:BASE diskette back in the manual. 

r3 I Follow this debug 'script*: 

RENAME RBASE.EXE RBASE.DAT 

DEBUG invoked without jiknaine. please 

N RBASE.DAT File nmie 

Assuming you have a 128K-I- machine... 

L 1000:0 ^>"^l 

(S) Search for these strings and (E) 
change them as shown: 



S 2000:0 L EFFF 7Z 10 E8 54 01 72 OB 
E 2000 22AB 90 90 ES 54 01 90 90 

S 2000:0 L EFFF 74 01 F9 IF C3 
E 2000:240E 74 01 F8 

S 2000:0 L EFFF B4 02 CD 13 
E 2000:22EB B4 04 90 F9 

S 2000:0 L EFFF SE CO BE 78 00 

E 2000:230C 90 90 90 90 90 90 90 90 90 

90 90 eleven 90s 

S 2000:0 L EFFF 52 B4 42 ES CI 00 

E 2000:231D 26 C7 06 00 09 50 04 26 C7 

06 02 09 E8 OF 26 C7 06 04 09 00 01 

26 C7 06 09 02 15 C3 

W 1000:0 ivriie it 

Q quit DEBUG 

RENAME RBASE.DAT RBASE.EXE 

Nute: Now all of the R:BASE copy- 
protection IS removed, and DISKCOPY-dhle. 
.All the cheeks (for spccialiy-lbmiatted tracks) 
have been completely removed. 

You may load all the files on the newly- 
formatted and unprotected diskette directly to 
hard-disk or RAM-disk, in any .sub- directory 
you set up 

Softkey for, . . 



Prokey v3.® 



Hard-disk drive is assumed as B: 

r 1 I Write -protect (tab) the ProKcy 
Distribution disk and put it in B: , and a DOS 
disk in floppy drive A: 

b: make h: the default drive 

AiDEBUG PKL0AD.COM invoke DEBUG 

G3FFC 

.fl,X=0100 BX=3FE1 CX=0000 DX=03F4 
SP=FFFE BP=4iCA Si =0920 D I =0110 
DS=0B4F ES=0B4F SS=0e4F CS=0B4F IP=3FFC 
NV UP El PL HI NA PO NC 



died regisier CX 
arid at the prompt (;) type: 



RCX 

CX 0000 

4DCA 

Now change disks in drive b: Use a 
formatted blank disk. 

W 

WRITING 40 CA BYTES 

Q qiiii DEBUG 

FroKcy is now unprotected. You may 
noW' manually copy all remaining files from 
the ProKcy distribution disk onto your fresh 
disk in B:. The resulting PALO/1 D.CO.W will 
start normally , and may even be copied onto 
a hard disk and run from there without the 
bother of putting the distribution disk into one 
of the floppy drivcsHI 



WL 
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LAYOUT. COM is protected in the same 

way as PKLOAD.COM. To 'adjust' 

LA YOUT. COM. use the same procedure as 

for PKLOAD with tiiese exceptions: 

Change AiDEBUG PKL0AD.COM 

to A:DEBUG LAYOUT.COM 

Change G 3FFC to G IFBF 

Change 40ca {Setting CX) to ZQM 
That's it! 



Daind G. Alexander 



Introduction to 



IBM Disk Format, Access 
and Copy Protection 



The following discussion will focus on the 
360K, 5 Vj " lloppy which is the most common 
format. 

Both sides of the disk are formatted and 
designated as sides O and 1 . Each side has 
40 tracks of 9 sectors each. Each sector 
contains 512 bytes of data. 

Sector ID field 

A sector has a sector identification (ID) 
field composed of Al Al M FE, four bytes 
(designating the track, side, sector number 
and size) and two CRC bytes. The sjze-ID 

byte for a 5 1 2-byte sector is 02 . 

Data Held 

Following the sec tor -ID field is a data 
field composed of Al Al Al F6, 512 bytes of 
data and two CRC bytes. 

The sectors arc separated by 00s (sync- 
bytes) and 4Es (gap-bytes). There is no 
nibblization scheme, and ASCII text appears 
normally in a raw track -dump. 

Each disk has a system area on side O, 
track O which has a one- sector boot record, 
a two -sector file-allocation table and at least 
one lOot directory. The files follow the root 
directory . 

Disk Access 

The IBM is an interrupt-driven machine, 
and disk access is performed by means of 
interrupt number $13. (In the Apple system 
we scan a disk looking for SC0SC,X disk- 
access codes) In the IBM system we look for 
CD 13 codes which unassemble to INT 13. 

The interrupt uses the AH-register to 
select the function to be used and performs 
a function comparable to an RWTS call in the 
Apple system. 

Here is a chart describing how the 
intcrrtipt is used. 



Table 1 



Registers 



Interrupt $13 codes 



AH= &<D Reset Disk 



AH= 01/?ead Status of Disk System to: 
AL= Return Code explanation 

00 Siiecessfu! 

01 Bad Command Given to /AT 

02 *Addrc.'>s Mark Not Found 

03 Writc-attenipt on write-protected disk 

04 *Reqiie.<ited Sector Not Found 

08 DMA Overrun 

09 Attempt to Cross DMA Boundary 

10 *Bad CRC on Disk Read 
20 Controller Failure 

40 Seek Operation Failure 

SO Attachment Failure 

* indicates most used in copy-protection 

AIi= <m Read Sectors 

Input DL= Drive Number (0-3) 

DH - Head (side) number (O- ) ) 

CH= Track Number 

CL= Sector Number 

AL= Number of Sectors to Read 

ES:BX= Load Address 

Output 

AH= Return code (carry flag ."set) 
AL = Number of Sectors Read 
AH = 3 Write (same pararns a.'i above) 
AH = 4 Verify (same params as above) 
AH= 5 Format (same params as above; 
ES:BX points to format table) 

Protection Schemes 

IBM copy -protection is generally simpler 
than Apple protection, with no quarter tracks 
and other exotic format alterations. 

The IBM equivalent to Apple's COPY A 
copy program is called DISKCOPY, and any 
non-standard sector format will stop it cold. 

Anything can be altered, such as sector 
numbers, sector order, sector size, 
deliberately incorrect CRC bytes, etc. 

The general copy-protection scheme is to 
provide at least one non-standard, preferably 
difficult-to-reproduce sector which will foil 
DISKCOPY and have a signature check in the 
program to perform an INT 13 operation on 
the altered sector. Whether or not the disk 
check pas.ses will depend on the return code. 

A very simple scheme would be to 
provide an altered sector which will generate 
a CRC error (carry flag set) when accessed. 
The code would look something like this. 

[NT 13 Read the sector 

JC 1B00 Cont inue program upon carry set 

(protected sector found) 
INT 19 Reboot 

This simple check can be disabled by 
changing the JC ]BG0 to J MP 1B00 so that the 



program will continue on to the code at 
SI BOO regardless of the outcome of the read 
operation . 

Self-modifying code 

However, many programs use self- 
modifying code to hide the CD 13s in the disk- 
check routines, and tt can take many hours 
of single-stepping through program code to 
unravel the protection. A typical example 
would be as follows. 



1600:0000 31DB 

1000:0002 8EDB 

1B00:0004 BB0DD0 

1600:0007 SA07 

1600:0009 3412 

1B00:000B 8807 
1B00:000D 



XORBX.BX 
MOV DS , BX 
MOVBX,000D 

moval,.:bx] 

X0RAL,12 
MOV ;bX\AL 
FIRST WORD 



In this section of code, [ALj is set to DF 
at location 1B00;0007. When you eXclusive- 
OR DF and 12 you get a CD (for the INT 
opcode) which is placed right next to a 13 at 
lB00:0e0D to produce a CD 13! 

Altered sectors can be identified using 
Locksmith PC. Central Point Software's PC 
Option Board, etc. Norton Utilities can be 
used to scan a disk or file for CD 13 codes 
which are not encoded. 

Programs including PC WATCH. 
TRAP 1 3 and INT L^ are resident "front end'' 
programs which intercept ROM BIOS 
interrupt- 13 calls to perform disk functions 
on specific sectors. The programs print out 
the requested disk drive, side, track, sector. 
number of sectors, and operation type 
contained in the registers listed earlier. After 
the internipi processing is completed, the 
program prints the status code returned (which 
indicates whether an error has occurred), and 
the address in the calling program to which 
control will be returned. 

Once the questionable INT 13 calls are 
found, the next step is to Unassemble the 
surrounding code using DEBUG and figure 
out how the routine works. 

Another way to decode the INT 13 calls 
is to use DEBUGS GO command. Set a 
breakpoint at the return address given by the 
front end program. When DEBUG stops, you 
will have decoded not only the INT 13 but 
everything else leading up to it. 

Once the disk check is located and 
analysed, the nc\t step is to figure out how 
to disable or bypass it. This will vary from 
disk to disk and is beyond the scope of this 
introduction. Happy IBM cracking I 



IBM RDEX END 



Send all contributions to: 

IBM-RDEX editor 

COMPUTIST 

PO Box 1I0846-T 

Tacoma, VVA 98411 
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CLASSIFIED ADS 



FOR SALE: Software 



A HACKER'S CHALLENGE is for 

hackers of the APPLE TT, In it 
arc graphical gamg'inDdulc5 you 
must play to discover CLUES. 
Your skills of DOS 3.3 lore & 
LiLillLy usage helps you to 
FIND and "clieat" youi v\ray nito 
the game a since they're hidden 
all over the disk. Yor goal 
is to solve ]ts GAME -SECRET 
that could win you an APPLE 11 
game prize if you'r one of the 
1 St ton to solve it! This two 
sided 5.25" game comes v^fith a 
DOS 3.3 and hint booklet. Send 
E9.95 to Mart V. Whitehursi, 
Box 4&5. Franklin Park, IL 
60131. Game demo disk only $2. 



RUINS of KELEDOOR - One of the 

IsL 3'D dungeon games vi/ith 
detailed and colored walls, 
monsters, piL'traps, secret 
doors, teleports, battle and 
mDvement sound effects to 
enhance game piay. Your 
postitioii is saved to the disk 
at any time. This two-sided 
5.25" APPLE II game is not 
protected and comes vjlth an 
adventure booklet. Send check 
or M.O. for $12.95 to Mark 
Whitehurst, Box 48e, Franklin 
Park, II 6Q131. 32 far demo 
disk. Dungeon maps only $1. 



FOR SALE: Software 



TRIVIA PYliAMID ia a hi -res 

game of 1 .0©® questions you 
and up to three friends csn 
play - or just you against the 
computer. You try to get your 
marker to the tap of the 
pyramid gameboard by answering 
trivia correctly. Options 

include i.he use of a timer, 
2-4 players {one can be the 
connputeO. selecting which of 
the eight trivia groups to use 
in the game. An included 
"Trivia Maker" uLiht.y allows 
you to create Trivia Disks of 
youT own! This two sided G.25" 
APPLE II game is not protected 
and comes with a booklet. Send 
S12.95 to Mark Whitehurst, 
Box 485, Franklin P^rk. IL 
60131. Demo disk is only $2. 



FOR SALE; Hardware 



WANTED 




Bulletin Boards 



Clubs & User Groups 



How To Place A Classified Ad 

For short ads. use this order farm. rorkrgerads,£ubinit'.vped copy with appropriate instructions. 
Remember, only 30. characters per line. 55 for the first line, $1 per line after that. 

ih 



S7 

$a 

S9 

. $10 

special Graphics irtslruftionsi The first (hm^ wards of the first line are printed in Iwld io^ hee. 
if yoii want other lines bolded, ^vrite BOLD== in :he first 6 spaces of that hne. There is a Si 
charge for each hne you want bolded. If you waat a line centered, write CENTF^R on the first 
Ef spaces of tliat line. Thfire is [lo chaige for centering any line. If you wan^ a kne.botli Bold and 
Centered. UTite CEMERBOLD on the first 10 character spaces. Your ad can be boxed for only 
S2 more. Clas&ihcation&: FOR SALE; Hardware, fOR SALE: software, WAKTED, ESCape 
{miscellaneous}, HELP!, Bulletin Boards, Clubs, or make up your own class tfication [f we think 
its useful, we'll use it. Ri'member. Yon tmts! prepay all dasiiflnd Gds. 

C la^si^^tion . 



Name. 
Address 

City 

Countr 



Zip 



Coun t ry _ 



Signature, . 



Exp. 



Total Number of lines: _ 
Number of bold lines_ 



Box costs $2 eJ^ra, _ 
$Tota] 3_ 



_.00 
..00 
,iOO 

_.oo 



^Washington orders add 7-S% sales tax. Send this forni and.a check-money 

order (funds drawn on US bank only) for the entire amount to: 

__ COMPUTiST CLASSIFIEpa PO Box il<>846 rm:oma. WA 9841 J 



Essential for any Serious Deprotectipn Workfl 



Graduate... 

to the. Senior PROM! 

A complete set of utilities 
instantly available In ROM to 



i 



p. <^ 

Senior 
Pr«m 






unTin&vacE 
hT. 



:^ 



examine, inodifi^, and backup your Apple software! 

The Senior PROM is a hardware device wilh Machine 
Language utilili^ instantly available from any program: 

• Enter the Monitor to examine or change memory. 

• Display where in memory a program was running. 

• Disassemble, view or save ANY memory. 

• Edit, search, and examine disks without booting DOS. 

• Initialize and copy disks without booting DOS first. 
Alt utilities in ROM & instantly available at any time! 
Sophisticated sector editor & memory/disk detective. 
Also, a program may be interrupted to examine or alter 
memory, & then restarted, or saved to disk & restarted. 
Includes many Machine Langauage utilities such as Step 
and Trace, an Assembler, and more. Undetectable by 
any software or hardware, doesn't use a peripheral slot. 
Economically priced at $ 7 9 • 9 5 for prepaid orders with 
check or money order. Credit card orders available for 
$88.95. Specify //c (without RAM expansion only), 
or lie (specify Standard or Enhanced ROMs). 



For 



nnmq 







order* call 317-743-4041, 10-5 E.S.T. 



or 313-3'49-2951- Modern 24 hr*. Net inttndtd fer ilk^nl ui*. 



Cutting 'S-dge'SL.nterppises 

43234c Ren Cen Station, Detroit, Ml 48243 




DEALERS CALL! 
UNIV Si school P.O.'s WELCOME! 



ONE MEG RAM BOARDS? 

WE'VE GOT EMt 

THE Super Expanders! 

S.E. Ilgs OK Now J49 

S.E. lie * OK Now $59 

S.E. lie 'OK 1/88 $69 

S,E. 11+ 'OK 3/88 $79 

Above with 256K = 
Above with 51 2K = CALL 
Above with 1MEG = 

• FREE Appleworks BAti/l 
Expansion Software! 

QUIET COOLING FANS! 

Ilgs No Audio Noise $25 

ll+/e w/Surge Protect $27 



OTHER PERIPHERALS! 



64K/80 Column Bd 


lie 


S35 


Super 64K/80 Col 


lie 


$49 


16K RA!^ Board 


11+ 


S35 


128K RAI^ Board 


11+ 


$65 


80 Column Board 


11+ 


$49 


Super Serial Bd 


ll+/e 


$49 


Z80 CP/M BoarO 


[l+/e 


$35 


Numeric Keypad 


lie 


$35 


Graphic Par Bd w/Cble 


$45 


Joystick $15 & 


$25 



A/B SWITCHBOX! 

Centronics or Serial 



$29 



ADD ON DISK DRIVE: 5Vt 

Specify Your Model $119 



TWO YEAR WARRANTY ON ALL PRODUCTS 

CALL OR WRITE FOR ILLUSTRATED LISTINGS! 

ADD S3 Shipping / COD ADD S£ / VISA/MC OKAY 0° 



NEXO DISTRIBUTION 

914 E. BTH ST., Suite 109, National City, CA 92050 

(619) 474-332B 10AM-6PM Mon-Fri 
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The Hacker's Ultimate Copy & Deprotection Utility 

Super lOB Collection [ 



ALL of our Super lOB controllers (through 1986) in 'ONE' package! 



COMPUTIST developed the ultimate copy program to 
remove copy protection from soltware: 

The Super 106 program. 

Since the introduction of Super lOB, COMPUTIST has 
used this flexible program to deprotect (or partially 
deprotect) dozens of commercial programs with far 
ranging protection schemes. 

Super lOB deprotects disks by using a modified RWTS 
{the subroutine in DOS whicfi is responsible for the 
reading and writing of disk sectors) for reading from the 
protected disk and then using a normal RWTS for writing 
to the deprotected disk. 

This package contains: 

^ TWO DISKS (supplied in DOS 3.3). Each disk contains at 
least 60 Super lOB Controllers including the standard, swap, 
newswap and fast controllers. Also included is version 1 .5 of 
Super lOB, the Csaver program from COMPUTIST No, 13, and 
a Menu Hello Program that lists the available controlters and, 
when you select one, automatically installs it in Super lOB and 
RUNs the resulting program.* 

► A reprint of Disk Inspection and the Use of Super lOB, 

trom COMPUTIST No. 17. This article explains how to write 
your own Super lOB controllers. 

*■ COIWPUTIST No. 32, which contains an extensive article 
detailing the hows and whys of Super lOB v1.5 and at least 
5 articles using the new Super lOB program. 

• Several of the controllers deprotect the software 
completely with no further steps. This means that some 
programs are only minutes away from deprotection (with 
virtually no typing). 

• The issue of COMPUTIST in which each controller 
appeared is indicated in case further steps are required to 
deprotect a particular program,** 



The SUPER lOB Collection 

Volume 1 of the Super lOB collection covers all the controMers 
from COMPUTIST No. 9 through No. 26. Also incliided are the 
hBwswap and fast controllers from COMPUTIST No. 32. The following 
SO controllers are on volurne 1: 
Advanced Blackjack, Alphabet Zoo, Arcade Macliine, Archon II, 
Arctign, Artsci Software, Bank Street Writer, Barrens SAT, 

Beyond Castle Wolfenstein, BSW lie Loader, Castle 
Woifenstein, Computer Preparation: SAT, DaiJie Draw, DB 

Master 4 Plus, Death Ir the Carribean, Dlno Eggs, DLM 

Software, Electronic Arts, F-15 Strike Eagle, Fast Controller, 

Fathoms 40, Financial Cookbook, Gessler Software, Grandma's 

House, The Heist, In Search of the Most Amazing Thing, Instant 

Recall, Kidwriter, Lions Share, Lode Runner, Mastertype, Match 

Maker, Miner 2049er, Minit Man, Mjfplot Newsroom, Newswap 

controller, Penguin Software, Print Shop Graphic Library, Print 

Shop, Rendezvous with Rama, Rockys' Boots, Sargon III, Sea 

Dragon, Shiela, Skyfox, Snooper Troops, Standard controller. 

Stoneware Software, Summer Games, Super Controlier, Super 

Zaxston, Swap Controller, TAC, Ultima I II, Word Challenge, 

Xyphus, Zaxxon 

Volume 2 of the Super lOB collection covers all the controllers 

from COMPUTIST No, 27 through No. 38. The following 65 controllers 

are on volume 2: 

Alice in Wonderland, Alphabetic Keyboarding, Alternate Reality, 

Autoduel, Checkers, Chipwits, Color Me, Conan.data, 

Conan.prog, CopyDOS, Crisis Mountain, Disk Director, 

Dragonworld, Early Games, Easy as ABC, F-15 Strike Eagle, 

Fantavislon, Fast controller, Fishies, Flight Sirnulator, Halley 

Project, Hartley Software (a). Hartley Software (b), Jenny of the 

Prarie, Jingle Disk, Kidwriter, Kracking Vol II, Lode Runner, 

LOGO II (a), LOGO II (b). Masquerade, Mastering the SAT, 

Microtype: The Wonderful World of Paws, Microzines 1 , 

MIcrozlnes 2-5. Miner 2049er. Mist & View to a Kill, Murder on 

the Zinderneuf, Music Construction Set, Newswap controller, 

Olympic Decathlon, Other Side, Phi Beta Filer, Pitstop II, Print 

Shop Companion. RDOS, Robot War, Spy vs Spy, Standard 

controller, Sundog V2, Swap controller. Sword of Kadash. 

Synergistic Software, Tawala's last Redoubt, Terrlpin Logo, 

Threshold, Time is Money. Time Zone, Tink! TonkI, Troll's Tale, 

Ultima IV, Wilderness, Word Attack & Classmate, World's 

Greatest Baseball, World's Greatest Football 



■ Yes, please send me The Super lOB Collection 

Includes both disks with Super lOB version 1.5, 
COMPUTIST #32, PLUS a reprint of "Disk Inspection 
artd the Use of Super lOB". 

11 US/Canada/Mexico lor $16.00 
n Other Foreign fur $20.00 

Send to: Super 10 B Collection 

PO Box 110846-T Tacoma, WA 98411 



Nanic_ 



JD#_ 



Address 
City 



State 



Zip 



Country _ 



Phone 



Exp. 



or call: (206) 474-5750 for 



ordcrs- 



*Requires at least G4K of memory. 

**Although some controllers will completely deprotect the program 
they were designed for, some will not. and therefore require their 
corresponding issue of COMPUTIST to eotnplctc the deprotection 
procedure. 



Sighatiirc 



CP,M 



Most orders arc shipped within 5 working days, however, please allow 
4 to 6 weeks for delivery. "Washington residents, please add l.S% sales tax. 

US funds dra-^vn on US banks 
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Legends tell or the days when the ancient back issues of Hardcore COMPUTIST were readily available to anyone who wished to purchase them. 
Those days may be long past, but the treasures with those ancient documents has been diligently transcribed to the pages of a modern relerence work: 

The Book(s) of Softkeys 



Volimni&e I Compiled from issues 1-5 

contains softkeys for: 'Akalabeth •Ampermagic "Apple Calaxian "Aztec "Bag of Tricks "Budge's Trilogy 
■Buzzard Bait "Cannonball Blitz "Casino "Data Reporter "Deadline "Disk Organizer II "Egbert II 
Communic. Disk 'Hard Hat Mack "Home Accountant "Ho me word "Lancaster "Magic Window II "Multi- 
disk Catalog "Multiplan "Pest Patrol "Prisoner II "Sammy Lightfoot "Screen Writer II "Sneakers "Spy's 
Demise "Starcross "Suspended "Ultima II "Visifile "Visiplot "Visitrend "Witness "Wizardry "Zork I "Zork 
II "Zork III ~" PLUS 'how-to' articles and listings of need-to-have programs used to make unprotected 
backups. 



Volume II Compiled from issues 6-10 

contains softkeys for: "Apple Cider Spider "Apple Logo "Artist Arcade Machine "Bank Street Writer 
"Caimonball Blitz "Canyon Climber "Caverns of Freitag "Crush, Crumble & Chomp "Data Factory V "DB 
Master "The Dic*tion*ary "Essential Data Duplicator I & III "Gold Rush "Krell Logo "Legacy of Llylgamyn 
•Mask Of The Sun "Minit Man "Mouskattack "Music Construction Set "Oil's Well "Pandora's Box 
•Robotron "Sammy Lightfoot "Screenwriter II v2.2 "Sensible Speller 4,4c,4.1c "Spy Strikes Back "Time 
Zone vl.l "Visible Computer: 6502 "Visidex "Visiterm "Zaxxon • software for: "Hayden "Sierra Online 
U PLUS the ultimate cracking program: Super lOB 1.6 """and more! 



Volume III Compiled from issues 11-15 

contains softkeys for: "Alien Addition "Alien Munchies "Alligator Mix "Comp. Prep. SAT "Cut 8Se Paste 
"Demolition Division. "DLM software "EA (Electronic Arts) software "Einstein CompOer 5.3 "Escape From 
Rungistan "Financial Cookbook "Flip Out • Hi-res Computer Golf II "Knoware "Laf Pak "Last Gladiator 
"Learning With Leeper "Lion's Share "Master Type 1.7 "MatheMagic "Minus Mission "Millionaire "Music 
Construction Set "One-on-one "Penguin software "PFS software "The Quest "Rocky's Boots "Sabotage 
"Seadragon "Sensible Speller 4 "Snooper Troops II "SoftPorn Adventure "Stickybear series "Suicide 
"TellStar "Tic Tac Show "Time Is Money "Transylvania "Type Attack "Ultima III Exodus "Zoom Graphics 
"Breaking Locksmith 5.0 Fast Copy L_ PLUS feature articles on • Csaver • The Core Disk Searcher 
• Modified ROMs. 



Name_ 



.ID#_ 



Address . 



City 



State 



Zip 



Country. 



_ Phone. 



Exp. 



Signature. 



.CP54 



□ Volume I - $7,95 

H- $2 sbippii !f; ih undUng 

[J Volumt; II - $12.95 

-I- 52 shipping/handUng- 

□ Volume III - SI 7.95 

-t- $2 xhipping/handiing 

L J All 3 volumes! - $30.00 

+ $2 shipping/handling 



Foreign orders (except Canada and Mexico) please add $5 for shipping and handling. Washington residents add 7.8?! .sates tax. 
Most orders are shipped within 5 working days, hiiwever. please allow 4-6 weeks delivery. US Funds drawn on US banks only. 

Send to: Book Of Softlsevs PO Box 110846-1 Tacoma. WA 98411 (206) 474-5 
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